What is the CVSS score of CVE-2025-8779?

CVE-2025-8779 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

WidgetKit for Elementor CVE-2025-8779

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-13 security@wordfence.com

WordPress XSS Wordpress Plugin Elementor

6.4

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Contributor authentication gives PR:L; stored injection needs no victim interaction to plant (UI:N); XSS executing in other users' browsers justifies S:C with limited C:L/I:L and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 20:40 vuln.today

tag: Elementor added

Analysis Generated

Oct 07, 2026 - 20:11 vuln.today

CVE Published

Dec 13, 2025 - 16:16 cve.org

MEDIUM 6.4

DescriptionCVE.org

The All-in-One Addons for Elementor - WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Team and Countdown widgets in all versions up to, and including, 2.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the All-in-One Addons for Elementor - WidgetKit WordPress plugin through version 2.5.6 lets an authenticated contributor-level user plant arbitrary JavaScript that executes in the browser of any visitor, including administrators, who views the affected page. The flaw is a classic CWE-79 weakness: the plugin's Team and Countdown widgets fail to sanitize input and escape output on user-supplied attributes, so widget configuration values are persisted and later rendered into the page unescaped. Exploitation requires only a contributor-or-higher account on a site running Elementor with the vulnerable plugin active; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is low at 0.22% (11th percentile), reflecting the authentication prerequisite.

Technical ContextAI

The root cause is improper neutralization of user input during web page generation (CWE-79), specifically a stored variant. WordPress page/post content authored by contributor-level users passes through the Elementor page builder, which renders plugin widgets such as WidgetKit's Team and Countdown modules. Those widgets accept admin-configurable attributes that the plugin writes into the generated HTML without adequate sanitization on input or escaping on output. Because the malicious payload is stored in post content rather than reflected in a request, it activates whenever any user, including a privileged administrator, loads the injected page, which is why the assessed vector carries Scope:Changed (S:C) - the script escapes the widget's own context and runs in the broader WordPress session/origin. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N confirms network reachability, low attack complexity, and a required low-privileged authenticated account (PR:L) with no user-interaction prerequisite (UI:N) from the victim beyond viewing the page; confidentiality and integrity impacts are limited. Affected deployments are identified by the WordPress plugin slug widgetkit-for-elementor (All-in-One Addons for Elementor - WidgetKit) at versions up to and including 2.5.6, requiring WordPress and the Elementor plugin to be installed and active.

Affected ProductsAI

The All-in-One Addons for Elementor - WidgetKit plugin for WordPress (plugin slug widgetkit-for-elementor) is affected in all versions up to and including 2.5.6 when used with the Elementor page builder. Any WordPress site with an active installation of this plugin is in scope; sites that grant contributor-or-higher roles to untrusted users face the greatest exposure. The referenced WordPress.org plugin page (https://wordpress.org/plugins/widgetkit-for-elementor/#developers) documents the plugin and its version history, and the vendor-side Trac changeset (https://plugins.trac.wordpress.org/changeset?old=3378162%40widgetkit-for-elementor&new=3378162%40widgetkit-for-elementor) records the source change associated with the fix. No CPE strings were supplied with the intelligence feed, so affected instances should be correlated by the plugin slug rather than by a formal CPE identifier.

RemediationAI

Update the WidgetKit for Elementor plugin to a release newer than 2.5.6. The upstream code change is captured in Trac changeset 3378162, which indicates a fix has landed in the plugin repository; however, a specific tagged patched version was not independently confirmed from the supplied data, so administrators should verify the newest available version on the WordPress.org plugin page and after applying changes confirm that the Team and Countdown widgets no longer persist unescaped attribute values. Until upgrading, reduce exposure by removing or tightly restricting contributor-and-above accounts on affected sites, since contributor privileges are the sole prerequisite (PR:L) - note this can disrupt legitimate editorial workflows; and, if operationally feasible, temporarily disable the Team and Countdown widgets or the plugin altogether, at the cost of losing the corresponding page features. Standard compensating controls such as a WordPress security plugin with output-filtering or a WAF can raise the bar but should not be treated as a substitute for the vendor fix because stored payloads already in the database may survive. Consult the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/dbbdf433-8589-4f5f-b73d-2dba58f684a7?source=cve and the plugin changelog for release-specific guidance.