Marquee Addons CVE-2025-8199
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor authentication is required so PR:L; network-reachable widget editor with no attacker UI gives AV:N/AC:L/UI:N; script executes in a victim's browser context, so S:C with C:L/I:L and A:N.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The MarqueeAddons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial Marquee widget in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the Marquee Addons for Elementor WordPress plugin (all versions up to and including 2.4.3) lets an authenticated attacker with contributor-level access or higher inject arbitrary JavaScript through the plugin's Testimonial Marquee widget, which then executes in the browser of any user who later views the compromised page. Exploitation requires a valid WordPress account with contributor capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, score 6.4), and the injection is confined to pages where the vulnerable widget is used, so sites that do not grant untrusted users contributor or author roles face materially lower exposure. There is no public exploit code identified at time of analysis and EPSS is low (0.22%, 11th percentile), so this is a moderate-urgency, post-authentication issue typically handled through routine plugin update cycles rather than emergency response.
Technical ContextAI
The issue is a classic stored (persistent) cross-site scripting flaw, CWE-79, rooted in insufficient input sanitization and output escaping of user-supplied attributes handled by the Testimonial Marquee widget shipped with the Marquee Addons plugin for Elementor. Marquee Addons extends the Elementor page-builder ecosystem, so widgets are configured through structured attribute fields whose values are persisted in WordPress post/block metadata and re-rendered on every page load; when those attribute values are echoed into the HTML response without context-appropriate escaping, injected markup and script survive storage and execute in the context of the hosting site's origin. Because the CVSS vector carries Scope:Changed (S:C) rather than Scope:Unchanged, the flaw is assessed as capable of affecting resources beyond the vulnerable component's own security boundary (for example, the broader site origin and any cookies or tokens scoped to it), although confidentiality and integrity impacts are rated Low and availability is not affected. The attack vector is network-based with low complexity, requires low privileges (PR:L - contributor-level or above in WordPress's role model), and needs no attacker-side user interaction (UI:N) because payload delivery is passive: the script fires only when a victim subsequently loads the injected page. WordPress contributor capabilities allow post creation and editing but not publishing, which is why the payload can be planted without immediate publication; the practical blast radius therefore depends on editorial workflows and on whether rendered previews, revisions, or published contributor content are accessible to other users.
Affected ProductsAI
The affected product is the WordPress plugin Marquee Addons (an Elementor add-on providing marquee-style widgets), in all versions up to and including 2.4.3, as stated in the CVE record; no CPE strings were supplied in the input data, so product identification relies on the vendor and plugin repository rather than formal CPE matching. Fixed code appears in the WordPress plugin Trac repository changeset 3349636 (https://plugins.trac.wordpress.org/changeset/3349636), and plugin version history plus update availability are documented on the WordPress.org plugin page at https://wordpress.org/plugins/marquee-addons-for-elementor/#developers. The vendor-adjacent advisory from Wordfence, which reported the issue, is at https://www.wordfence.com/threat-intel/vulnerabilities/id/ab664bc5-ef3c-4e5a-99d5-e3f1bb240a70?source=cve and should be consulted for the authoritative version mapping, since the exact patched release number is not explicitly enumerated in the supplied data. Any WordPress site running the plugin at or below 2.4.3 with at least one user holding contributor-level or higher privileges should be treated as potentially affected.
RemediationAI
Apply the vendor fix by updating the Marquee Addons plugin beyond version 2.4.3 through the WordPress admin Plugins screen or WP-CLI; the corrective changeset is published in the plugin repository at https://plugins.trac.wordpress.org/changeset/3349636, and release/version details are tracked at https://wordpress.org/plugins/marquee-addons-for-elementor/#developers, while the reporting advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ab664bc5-ef3c-4e5a-99d5-e3f1bb240a70?source=cve should confirm the patched version for your installed build. Where immediate updating is not possible, the highest-value compensating control is role hygiene: audit and remove or downgrade contributor-and-above accounts on the affected site and disable open contributor/author self-registration, since the vulnerability is only reachable by an account with that capability - the trade-off is operational friction for legitimate content contributors. A second option is to disable or stop using the Testimonial Marquee widget until patched, or to remove Marquee Addons entirely if the widget is not required; this eliminates the attack surface but breaks any existing pages or templates that depend on the widget. Additional hardening such as a WordPress security plugin offering output filtering or a Content-Security-Policy that disallows inline script can reduce the chance that an injected payload executes, but CSP tuning is error-prone and may break legitimate Elementor-rendered content, so it should be treated as defense in depth rather than a substitute for the patch. Because exploitation is stored and executes when a victim views the injected page, also review recent contributor-authored posts, widget configurations, and post revisions for suspicious markup, and purge any identified payloads after upgrading.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today