CVE-2025-0433 Overview
CVE-2025-0433 is a Stored Cross-Site Scripting (XSS) vulnerability in the Master Addons – Elementor Addons plugin for WordPress. The flaw affects all versions up to and including 2.0.7.1. Attackers with Contributor-level access or higher can inject arbitrary JavaScript through the id parameter due to insufficient input sanitization and output escaping [CWE-79]. Injected scripts execute in the browser of any user who visits an affected page. The vulnerability is categorized as MEDIUM severity and requires authentication combined with victim interaction.
Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, administrative action hijacking, and redirection of site visitors.
Affected Products
- Master Addons for Elementor (master-addons/master_addons) — all versions ≤ 2.0.7.1
- WordPress installations running the vulnerable plugin
- Sites permitting Contributor-level or higher user registration
Discovery Timeline
- 2025-03-04 - CVE-2025-0433 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0433
Vulnerability Analysis
The vulnerability resides in the Master Addons plugin's handling of the id parameter within widget rendering code. Specifically, affected code paths include ma-image-hover-effects.php and ma-tabs.php, where the id value is emitted into rendered HTML without sufficient sanitization or output escaping. When a Contributor-level user configures a widget, they can supply a crafted id value containing HTML or JavaScript payloads. The plugin stores this value in post metadata and later echoes it into page output. Any visitor rendering the affected page—including administrators reviewing pending content—triggers execution of the injected script in their session context.
Root Cause
The root cause is missing sanitization on input and missing escaping on output for the id attribute used by multiple widget renderers. WordPress provides functions such as esc_attr() and sanitize_html_class() for this purpose, but the vulnerable versions did not apply them consistently to the id field. Because widget settings persist in the database, the payload becomes a Stored XSS rather than a Reflected one.
Attack Vector
Exploitation requires an authenticated account with the Contributor role or above and user interaction from a victim who loads the affected page. The attack scope is changed, meaning script execution can impact resources beyond the vulnerable plugin's boundary, such as the administrator's browser session. A typical attack flow: the contributor creates or edits a page containing a Master Addons widget, sets the widget id to a crafted payload, saves the draft, and awaits editor or admin review. See the WordPress Plugin Code Snippet for image hover effects and WordPress Plugin Code Snippet for tabs for the pre-patch code paths.
Detection Methods for CVE-2025-0433
Indicators of Compromise
- Unexpected <script> tags, event handlers (onerror, onclick), or javascript: URIs stored within Elementor widget metadata in wp_postmeta
- Anomalous id attribute values in rendered pages containing quotes, angle brackets, or JavaScript keywords
- Outbound requests from administrator browsers to unfamiliar domains shortly after viewing content authored by low-privileged users
- New administrator accounts or modified user roles created without a corresponding admin session
Detection Strategies
- Query the wp_postmeta table for Master Addons widget settings and search for HTML-encoded or raw script payloads in the id field
- Monitor WordPress access logs for Contributor accounts submitting POST requests that include suspicious characters in widget parameters
- Deploy a Web Application Firewall (WAF) rule to flag stored payloads containing script tags or event handlers within Elementor-related requests
Monitoring Recommendations
- Alert on privilege changes, plugin installations, and theme edits performed by administrative sessions immediately after previewing Contributor content
- Review the plugin version inventory across WordPress hosts and flag any Master Addons instance at 2.0.7.1 or earlier
- Enable Content Security Policy (CSP) reporting to capture script execution violations that indicate injected payloads
How to Mitigate CVE-2025-0433
Immediate Actions Required
- Update the Master Addons plugin to a version later than 2.0.7.1 that incorporates the fix from WordPress Changeset #3243199
- Audit existing pages built with Master Addons widgets and remove any suspicious id values before restoring the plugin to production use
- Review recently created Contributor and Author accounts, and revoke access for any that appear illegitimate
Patch Information
The vendor addressed the vulnerability in the changeset published at WordPress Changeset #3243199. Additional developer information is available on the WordPress Master Addons Developer page and the Wordfence Vulnerability Details advisory.
Workarounds
- Temporarily deactivate the Master Addons plugin until it is updated on all affected WordPress sites
- Restrict Contributor-level registration and require moderator approval for all new low-privilege accounts
- Deploy a WAF ruleset that strips or blocks script tags and event handlers submitted to Elementor widget endpoints
- Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored payloads
# Update Master Addons via WP-CLI on affected WordPress hosts
wp plugin update master-addons --version=latest
wp plugin list --name=master-addons --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
