CVE-2025-2225: Responsive Addons For Elementor XSS Flaw

CVE-2025-2225 Overview

CVE-2025-2225 is a Stored Cross-Site Scripting (XSS) vulnerability in the Responsive Addons for Elementor WordPress plugin developed by Cyberchimps. The flaw affects all versions up to and including 1.6.9 and stems from insufficient input sanitization and output escaping of the rael_title_tag parameter within the Icon Box widget. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who loads the affected page. The vendor released only a partial patch in version 1.6.9, meaning administrators must apply subsequent updates to fully remediate the issue.

Critical Impact
Authenticated Contributor accounts can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and site defacement.

Affected Products

Cyberchimps Responsive Addons for Elementor plugin for WordPress (versions up to and including 1.6.9)
The rael_title_tag parameter in the Icon Box widget (class-responsive-addons-for-elementor-icon-box.php)
WordPress sites allowing Contributor-level (or higher) user registration or authoring

Discovery Timeline

2025-04-15 - CVE-2025-2225 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2225

Vulnerability Analysis

The vulnerability is classified as Stored Cross-Site Scripting under CWE-79. It resides in the Icon Box widget of the Responsive Addons for Elementor plugin. The widget accepts a rael_title_tag parameter that determines the HTML tag used for rendering the icon box title. The plugin fails to sanitize this value on input and does not escape it on output. An attacker with Contributor privileges can save a post or page containing crafted tag content. The malicious payload persists in the WordPress database and executes whenever the affected page is rendered. Because the payload is stored, every subsequent visitor, including administrators, becomes a target.

Root Cause

The Icon Box widget concatenates the user-supplied rael_title_tag value directly into rendered HTML without allow-listing valid tag names or escaping attribute contexts. The vendor's changeset 3261241 addressed the initial reporting, and changeset 3263280 provided additional hardening after the 1.6.9 release proved to be a partial fix. Reviewers can inspect the affected rendering logic in the plugin source.

Attack Vector

Exploitation requires an authenticated session at Contributor level or above and user interaction from a victim who loads the injected page. The attacker edits an Elementor page containing the Icon Box widget and supplies a malicious tag value that breaks out of the intended HTML context. When a logged-in administrator previews the post for moderation or a visitor views the published page, the injected script runs under the origin of the WordPress site. Consequences include cookie theft, forced administrative actions via forged requests, plugin backdoor installation, and pivoting to full site takeover.

No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-2225

Indicators of Compromise

Post or page meta entries containing rael_title_tag values that include angle brackets, on* event handlers, javascript: URIs, or <script> fragments
Unexpected outbound requests from browsers rendering Elementor pages to attacker-controlled domains
New WordPress administrator accounts created shortly after a Contributor edited an Icon Box widget
Modifications to wp_posts or wp_postmeta rows containing serialized Elementor data with encoded script payloads

Detection Strategies

Query the WordPress database for postmeta rows referencing Elementor data where rael_title_tag values are not in the expected allow-list (h1–h6, div, span, p)
Deploy web application firewall rules that inspect POST bodies to admin-ajax.php and Elementor save endpoints for script patterns in rael_title_tag
Enable audit logging for Contributor and Author role activity, specifically post revisions containing HTML control characters

Monitoring Recommendations

Alert on Content Security Policy (CSP) violation reports originating from Elementor-rendered pages
Monitor administrative session cookies for reuse from unexpected IP addresses following any Contributor edit
Track version metadata of installed WordPress plugins and flag any environment still running Responsive Addons for Elementor 1.6.9 or earlier

How to Mitigate CVE-2025-2225

Immediate Actions Required

Update the Responsive Addons for Elementor plugin to the latest version released after 1.6.9 that incorporates changeset 3263280
Audit all pages using the Icon Box widget and inspect the rael_title_tag field for injected markup
Review Contributor, Author, and Editor accounts and revoke access for untrusted users
Rotate administrator session cookies and passwords if untrusted Contributors edited content prior to patching

Patch Information

Cyberchimps released a partial fix in version 1.6.9 and additional hardening via WordPress plugin changeset 3263280. Administrators must install the release containing both changesets to fully remediate CVE-2025-2225. Confirm the plugin version in the WordPress admin dashboard under Plugins after updating.

Workarounds

Restrict user registration and remove Contributor-level access from untrusted accounts until the patched release is installed
Deploy a web application firewall rule that blocks script characters submitted in the rael_title_tag request parameter
Temporarily deactivate the Responsive Addons for Elementor plugin if patching cannot be performed immediately
Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by Elementor widgets

bash

# Example WP-CLI commands to check plugin version and update
wp plugin get responsive-addons-for-elementor --field=version
wp plugin update responsive-addons-for-elementor
wp user list --role=contributor --fields=ID,user_login,user_registered