CVE-2025-2108: Xpro Addons Elementor XSS Vulnerability

CVE-2025-2108 Overview

CVE-2025-2108 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress. The flaw exists in the Site Title widget through the title_tag and html_tag parameters. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or above to inject arbitrary JavaScript. Injected scripts execute in the browser of any user viewing an affected page. The vulnerability is tracked as CWE-79 and affects all plugin versions up to and including 1.4.6.8.

Critical Impact
Authenticated contributors can persist arbitrary JavaScript in published pages, enabling session theft, admin account takeover, and drive-by redirection against site visitors.

Affected Products

Xpro Addons For Elementor – FREE (WordPress plugin)
All versions up to and including 1.4.6.8
Sites where Contributor-level or higher accounts are provisioned

Discovery Timeline

2025-03-20 - CVE-2025-2108 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2108

Vulnerability Analysis

The vulnerability resides in the Site Title widget shipped with the Xpro Addons For Elementor plugin. The widget accepts user-controlled values for the title_tag and html_tag parameters, which are intended to specify HTML tag names such as h1 or h2. The plugin renders these parameters into the frontend markup without adequate sanitization or output escaping.

An authenticated user with Contributor privileges or higher can supply crafted payloads through the Elementor editor. Because the widget stores the payload in post meta and renders it on every page view, the injection is persistent. The frontend.php rendering routine emits the attacker-controlled tag directly into the DOM, allowing arbitrary HTML and JavaScript execution when a visitor loads the page. See the vulnerable code path in WordPress Plugin Frontend Code.

Root Cause

The root cause is missing input validation on tag-name parameters and missing output escaping in the frontend render function. The plugin trusts editor-supplied strings that should be constrained to a fixed allowlist of HTML tag identifiers. Rendering user input into HTML context without escaping violates CWE-79.

Attack Vector

An attacker registers or compromises a Contributor account, then inserts the Site Title widget into a draft post or page. The attacker injects a payload into the title_tag or html_tag field that breaks out of the intended tag context and introduces a <script> element or event handler. When the page is previewed by an editor, published by an administrator, or visited by any user, the JavaScript executes with the victim's session privileges. This enables cookie theft, CSRF against administrative endpoints, and pivoting to full site compromise. Technical remediation details are documented in WordPress Changeset #3255986 and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-2108

Indicators of Compromise

Post meta entries for Elementor widgets containing <script>, onerror=, onload=, or javascript: strings within title_tag or html_tag fields
Unexpected Site Title widget instances created by Contributor-level accounts
Outbound requests from site visitors to attacker-controlled domains hosting external JavaScript payloads
New or modified administrator accounts following Contributor activity

Detection Strategies

Query the WordPress wp_postmeta table for Elementor widget data containing suspicious tag values or angle brackets in title_tag and html_tag keys
Review Elementor revision history for edits made by low-privileged users that alter widget markup
Monitor web server access logs for anomalous outbound script sourcing on pages containing the vulnerable widget

Monitoring Recommendations

Alert on creation or modification of posts by Contributor accounts that include Xpro Addons widgets
Track installed plugin versions across managed WordPress fleets and flag any instance of xpro-elementor-addons at or below 1.4.6.8
Enable Content Security Policy reporting to surface unexpected inline script execution on public pages

How to Mitigate CVE-2025-2108

Immediate Actions Required

Update the Xpro Addons For Elementor – FREE plugin to a version above 1.4.6.8 that includes the fix from WordPress Changeset #3255986
Audit all Contributor, Author, and Editor accounts and disable any that are inactive or unrecognized
Inspect existing pages using the Site Title widget for injected payloads and purge affected post meta

Patch Information

The vendor addressed the vulnerability by adding proper sanitization to the title_tag and html_tag parameters. Site operators must upgrade to the patched release published after changeset 3255986. Verify plugin integrity after upgrade by comparing installed files with the WordPress.org repository.

Workarounds

Deactivate and remove the Xpro Addons For Elementor – FREE plugin until the patch is applied
Restrict Contributor and Author role assignments to trusted users only
Deploy a Web Application Firewall rule that blocks HTML tag characters in Elementor widget POST parameters
Implement a strict Content Security Policy that disallows inline scripts and untrusted script sources

bash

# Update the plugin via WP-CLI on the affected host
wp plugin update xpro-elementor-addons

# Verify installed version is above 1.4.6.8
wp plugin get xpro-elementor-addons --field=version

# Search post meta for suspicious tag values
wp db query "SELECT post_id, meta_key FROM wp_postmeta WHERE meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%';"