What is the CVSS score of CVE-2025-69092?

CVE-2025-69092 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Essential Addons CVE-2025-69092

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-30 audit@patchstack.com

WordPress XSS Essential Addons For Elementor Wordpress Plugin Wpdeveloper

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Authenticated contributor-level content injection (PR:L) requiring a victim to render the payload (UI:R); DOM-XSS executing cross-context yields scope change with limited C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 01, 2026 - 08:33 vuln.today

CVE Published

Dec 30, 2025 - 11:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.

AnalysisAI

DOM-based cross-site scripting in the Essential Addons for Elementor Lite WordPress plugin (all versions through 6.5.3) allows an authenticated low-privileged user - typically Contributor level or above, able to create or edit Elementor content - to inject a payload that executes in a victim's browser when that victim views or interacts with the crafted page (CVSS 6.5, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). Exploitation is constrained by two prerequisites: the attacker must already hold an authenticated WordPress account, and a second user must be lured into interacting with the poisoned content, so impact is limited to script execution in the victim's browser rather than server compromise. No public exploit code has been identified and the CVE is not in CISA KEV; EPSS is 0.15% (4th percentile), reinforcing that this is a low-priority issue despite the medium base score.

Technical ContextAI

The root cause is CWE-79, improper neutralization of input during web page generation, specifically the DOM-based XSS subclass in which untrusted input is written into client-side sinks (such as innerHTML, document.write, or location handling) by the plugin's Elementor widget JavaScript rather than being reflected by server-side PHP. Because the flaw lives in the browser-side rendering path, the malicious payload does not need to traverse the server response, and the CVSS scope change (S:C) reflects that the injected script executes in the security context of the page's origin, potentially reaching other users of the same WordPress site. The CPE cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:* explicitly scopes the issue to the Lite (free) edition of the WPDeveloper Essential Addons for Elementor plugin on WordPress; the Pro edition is not covered by the supplied CPE. The PR:L and UI:R vector components confirm that a low-privileged authenticated account is required and that a separate victim must view or interact with the rendered page, which is the decisive factor capping realistic severity.

RemediationAI

Update the Essential Addons for Elementor Lite plugin to a release later than 6.5.3 - the advisory lists 6.5.3 and earlier as vulnerable, and the vendor's plugin channel at https://patchstack.com/database/Wordpress/Plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-5-3-cross-site-scripting-xss-vulnerability?_s_id=cve is the authoritative source; note that the exact patched version number is not specified in the available data, so confirm the fixed release on the vendor page before upgrading. Because the vector requires PR:L, the most effective compensating control is to tighten WordPress role assignments so untrusted or low-trust accounts cannot create or edit Elementor content (Contributor and above) - the trade-off is reduced editorial flexibility for those users. If immediate upgrading is impossible, harden the browser layer with a Content-Security-Policy that disallows inline and untrusted script sources (expect to break some legitimate widget functionality until the policy is tuned), and deploy a WAF rule set covering the plugin's endpoints, accepting that WAF signatures are bypassable and do not remove the underlying client-side sink. Ensure administrative and privileged users are trained not to open or interact with untrusted Elementor-rendered pages, since UI:R means victim interaction is a necessary condition for exploitation.