JetWidgets Elementor Plugin CVE-2025-8195
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor authentication is required so PR:L; stored payload needs no victim interaction to inject (UI:N), executes cross-context (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison and Subscribe widgets in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the JetWidgets For Elementor plugin for WordPress (all versions up to and including 1.0.20) allows authenticated attackers holding contributor-level access or higher to inject arbitrary JavaScript through the Image Comparison and Subscribe widgets, which then executes in the browser of any user who loads the injected page - including administrators. The defect is a classic CWE-79 failure: user-supplied widget attributes are neither sanitized on input nor escaped on output, giving it a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No public exploit code exists and there is no confirmed active exploitation at time of analysis; EPSS is low at 0.22% (12th percentile), so risk is concentrated in sites that grant untrusted users contributor-level or higher accounts.
Technical ContextAI
The target is a WordPress plugin that registers custom Elementor widgets - specifically an Image Comparison widget (includes/addons/jet-widgets-image-comparison.php) and a Subscribe form widget (includes/addons/jet-widgets-subscribe-form.php) - whose rendered markup is driven by attributes stored in the post/page content authored through the Elementor editor. Because the plugin neither sanitizes those attribute values on save nor escapes them when building the front-end HTML, attacker-controlled strings survive into the page output. This falls under CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. stored/persistent XSS). The CVSS scope-changed rating (S:C) reflects that script execution escapes the vulnerable widget component and runs in the security context of the hosting WordPress site and its authenticated users. Exploitation prerequisites are an authenticated account at contributor level or above (PR:L) and a site where at least one of the two affected widgets is actually placed and rendered on a page that a victim later visits. No CPE strings were supplied with the source data, so the affected artifact is identified by plugin slug (jetwidgets-for-elementor) and the version ceiling stated in the description; the vendor's Trac repository contains the relevant 1.0.20 source files referenced by NVD.
Affected ProductsAI
The JetWidgets For Elementor plugin for WordPress, all versions up to and including 1.0.20, with the vulnerable surface concentrated in the Image Comparison widget (https://plugins.trac.wordpress.org/browser/jetwidgets-for-elementor/tags/1.0.20/includes/addons/jet-widgets-image-comparison.php) and the Subscribe form widget (https://plugins.trac.wordpress.org/browser/jetwidgets-for-elementor/tags/1.0.20/includes/addons/jet-widgets-subscribe-form.php). The plugin is distributed through the WordPress.org directory (https://wordpress.org/plugins/jetwidgets-for-elementor/#developers), and the vulnerability is reported by Wordfence with a dedicated threat-intel entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/9d8a03f7-a028-401c-9088-77e75dd365f6?source=cve. Any WordPress installation running a version at or below 1.0.20 that uses either widget is in scope; installations that never render these widgets cannot be reached through this path.
RemediationAI
Apply the upstream fix and update the plugin above version 1.0.20 - the NVD references point to a Trac changeset (r3364453 in jetwidgets-for-elementor, https://plugins.trac.wordpress.org/changeset?old=3364453%40jetwidgets-for-elementor&new=3364453%40jetwidgets-for-elementor), so an upstream fix is available (PR/commit); the exact released version number that ships it is not independently confirmed in the supplied data, so verify the currently offered release in the WordPress.org plugin repository or via the Wordfence advisory before considering the site mitigated. Until the update is verified, reduce exposure by tightening role assignments: block or downgrade contributor-and-above accounts for untrusted users (side effect: legitimate editorial workflows are interrupted), and remove or disable the Image Comparison and Subscribe widgets from existing pages so no attacker-controlled attributes remain in stored content (side effect: pages using those layouts lose the widgets and any content in them must be re-authored). Sites that cannot immediately patch should pair a WordPress-aware WAF rule targeting script/HTML payloads in plugin widget attributes with a restrictive Content-Security-Policy that disallows inline script (side effect: CSP may break other plugins and theme scripts that rely on inline JavaScript, and WAF attribute filtering can produce false positives on legitimate widget configuration). Because the payload is stored, also audit posts and pages authored by low-privilege accounts for lingering injected markup after patching.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today