What is the CVSS score of CVE-2025-9077?

CVE-2025-9077 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ultra Addons Lite are affected by CVE-2025-9077?

Organizations using Ultra Addons Lite for Elementor should be aware of moderate risk from CVE-2025-9077, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2025-9077?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Ultra Addons Lite CVE-2025-9077

EUVD-2025-32552 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-10-03 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Requires contributor-level access (PR:L); stored XSS requires no attack complexity; scope changed due to impact on other users; limited confidentiality and integrity.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:33 vuln.today

EUVD ID Assigned

Mar 13, 2026 - 19:29 euvd

EUVD-2025-32552

CVE Published

Oct 03, 2025 - 12:15 nvd

MEDIUM 6.4

DescriptionCVE.org

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and below due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Authenticated contributors to WordPress sites running Ultra Addons Lite for Elementor version 1.1.9 and below can inject persistent malicious scripts through the Typeout Widget's Animated Text field, executing in the browsers of all users who visit affected pages. The root cause is insufficient input sanitization in the vulnerable code component. Despite a moderate CVSS score of 6.4, the EPSS probability of 0.03% (9th percentile) indicates minimal real-world exploitation risk, with no confirmed active exploitation or public exploit code identified to date.

Technical ContextAI

The vulnerability exists in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the Typeout Widget component located at ut-elementor-addons-lite/elements/typeout.php line 276. The plugin fails to sanitize user input from the Animated Text field before storing it in the WordPress database, then fails to escape the stored content when rendering it to page visitors. This enables stored cross-site scripting, where malicious JavaScript persists in the database and executes in every visitor's browser context without additional user action, bypassing the same-origin policy through the web application itself.

RemediationAI

Update Ultra Addons Lite for Elementor to version 1.2.0 or later via the WordPress plugin dashboard's automatic update mechanism or manual download from wordpress.org/plugins/ut-elementor-addons-lite/. For organizations unable to immediately update, implement compensating controls: restrict contributor-level access to only essential personnel and regularly audit who holds this role, disable the Typeout Widget feature if it is not actively used, or consider deactivating the entire plugin until patched. In WordPress multisite deployments, prioritize network-wide updates to ensure all sites receive the fix simultaneously. The patch is available with no reported compatibility issues or breaking changes.