EUVD-2025-32536Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects mandatory contributor authentication; S:C captures cross-user browser impact; no availability impact applies for stored XSS.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Easy Elementor Addons WordPress plugin (versions ≤ 2.2.8) enables authenticated attackers holding contributor-level roles to inject persistent JavaScript payloads into pages through unsanitized parameters in the countdown and image-comparison widgets. Any site visitor who loads an injected page will execute the malicious script in their browser, enabling session hijacking, credential theft, or malicious redirects. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.05% (14th percentile) indicates low automated exploitation probability, though the low privilege barrier makes this a realistic insider or compromised-account threat.
Technical ContextAI
Easy Elementor Addons is a third-party WordPress plugin that extends the Elementor page builder with additional widgets. The flaw is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), specifically the failure to sanitize user-supplied values on input and escape them on output within widget rendering code. Vulnerable parameters have been identified in at least two widget implementations: the countdown widget (modules/countdown/widgets/countdown.php, lines 864, 868, and 871 in the 2.2.8 tag) and the image-comparison widget (modules/image-comparison/widgets/image-comparison.php, lines 376 and 377 in the 2.2.8 tag). The WordPress plugin repository trac browser confirms corrected code present in the 2.3.0 tag, indicating the fix addresses these specific lines. The CVSS scope metric is Changed (S:C), reflecting that exploitation impacts users beyond the authenticated attacker - specifically any visitor whose browser renders the poisoned page.
RemediationAI
Update the Easy Elementor Addons plugin to version 2.3.0 or later, as the WordPress plugin trac repository confirms corrected output escaping in the countdown and image-comparison widget files at that tag (https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.3.0/). The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/08640d56-fc76-4062-ab08-19415ad77e5e should be consulted for confirmation of the fix version. As a compensating control where immediate patching is not possible, restrict contributor-level role assignment to trusted users only, and consider disabling the countdown and image-comparison widgets via plugin settings or a security plugin with widget-level access controls - note this will impact site functionality using those widgets. WordPress WAF rules (available via Wordfence or similar) targeting stored XSS in Elementor widget parameters provide an additional detection and blocking layer with minimal operational side effects.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today