Skip to main content

ModelTheme Addons CVE-2025-68532

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2025-12-24 audit@patchstack.com
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
6.5 MEDIUM

Authenticated stored XSS with scope change and low impacts across confidentiality, integrity, and availability.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Jul 26, 2026 - 16:20 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Stored XSS.This issue affects ModelTheme Addons for WPBakery and Elementor: from n/a through < 1.5.6.

AnalysisAI

Stored cross-site scripting in ModelTheme Addons for WPBakery and Elementor plugin for WordPress through version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary web scripts. When a victim, such as an administrator, views the affected page, the injected script executes in their browser, leading to potential session hijacking, credential theft, or site defacement. No active exploitation or public exploit code is known at this time, and EPSS probability is very low (0.04%).

Technical ContextAI

This vulnerability exists in the ModelTheme Addons for WPBakery and Elementor WordPress plugin (slug: modeltheme-addons-for-wpbakery), which extends page builder functionality. The root cause is improper neutralization of user-supplied input during web page generation (CWE-79), failing to sanitize data before storing and later outputting it without escaping. The affected component likely handles content elements or settings where authenticated users can inject malicious JavaScript, which is then rendered unsanitized on the frontend for other users.

Affected ProductsAI

ModelTheme Addons for WPBakery and Elementor (modeltheme-addons-for-wpbakery) all versions before 1.5.6. The fixed version 1.5.6 addresses this vulnerability. More details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/modeltheme-addons-for-wpbakery/vulnerability/wordpress-modeltheme-addons-for-wpbakery-and-elementor-plugin-1-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve.

RemediationAI

Update the ModelTheme Addons for WPBakery and Elementor plugin to version 1.5.6 or later immediately. If immediate patching is not possible, consider restricting contributor access or disabling the plugin until the update can be applied. Ensure that WordPress core and all themes/plugins are kept up to date to reduce attack surface. There are no effective workarounds short of patching, as eliminating contributor privileges for content creation may not be feasible in typical publishing workflows.

CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL POC
9.8 May 23

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-44000 CRITICAL POC
9.8 Oct 20

Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote

CVE-2020-36847 CRITICAL POC
9.8 Jul 12

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-27007 CRITICAL POC
9.8 May 01

The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut

CVE-2016-1209 CRITICAL POC
9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL POC
9.8 May 22

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL POC
9.8 Feb 27

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL POC
9.8 Jan 11

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL POC
9.8 Feb 17

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-4295 CRITICAL POC
9.8 Jun 05

The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in

CVE-2024-50498 CRITICAL POC
10.0 Oct 28

Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u

Share

CVE-2025-68532 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy