CVE-2025-7498 Overview
CVE-2025-7498 is a stored Cross-Site Scripting (XSS) vulnerability in the Exclusive Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 2.7.9.4 and resides in the plugin's Countdown Widget. Insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript. The injected scripts execute in the browser of any user who views the affected page. The issue is tracked under CWE-79 and documented in the Wordfence Vulnerability Report.
Critical Impact
Authenticated contributors can store malicious JavaScript in Countdown Widget attributes, enabling session theft, redirects, and administrator account takeover when a privileged user views the page.
Affected Products
- Exclusive Addons for Elementor (free) — versions * through 2.7.9.4
- WordPress sites running the plugin with Contributor or higher accounts enabled
- Pages rendered with the plugin's Countdown Widget
Discovery Timeline
- 2025-08-06 - CVE-2025-7498 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7498
Vulnerability Analysis
The vulnerability exists in the Countdown Widget shipped with Exclusive Addons for Elementor. The widget accepts user-supplied attributes that are rendered into the DOM by the plugin's front-end script exad-scripts.js and the bundled jquery.countdown.min.js library. Because the plugin does not properly sanitize these attributes on input or escape them on output, an attacker can store HTML and JavaScript payloads inside widget configuration fields. When a visitor loads a page containing the compromised widget, the browser parses the attacker-controlled markup and executes the embedded script in the context of the site's origin. Review the vulnerable rendering logic in the plugin JS source.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The Countdown Widget stores attributes submitted by editors without applying WordPress sanitization helpers such as wp_kses_post() or sanitize_text_field(), and the output path omits esc_attr() or esc_html() before writing values into page markup.
Attack Vector
Exploitation requires an authenticated session with Contributor-level privileges or higher. The attacker edits or creates a post containing the Countdown Widget, injects a JavaScript payload into a vulnerable widget attribute, and saves the content. When another user, including an administrator, previews or views the page, the stored payload executes with the site's privileges. This can be chained to steal authentication cookies, create rogue administrator accounts via the WordPress REST API, or redirect visitors to attacker-controlled infrastructure. See the vendor fix in the plugin changeset for the specific sanitization changes applied.
Detection Methods for CVE-2025-7498
Indicators of Compromise
- Post or page content containing <script> tags, on* event handlers, or javascript: URIs inside Countdown Widget attributes.
- Unexpected administrator accounts, modified user roles, or new application passwords created shortly after Contributor activity.
- Outbound requests from visitor browsers to unfamiliar domains originating on pages that embed the Countdown Widget.
Detection Strategies
- Query the WordPress wp_posts table for post content containing Elementor Countdown Widget markup paired with suspicious strings such as onerror=, onload=, or <script.
- Review audit logs for Contributor and Author accounts editing posts that embed the Countdown Widget on versions 2.7.9.4 or earlier.
- Inspect browser console telemetry and web application firewall logs for reflected or stored XSS patterns targeting Elementor widget endpoints.
Monitoring Recommendations
- Enable WordPress activity logging to capture post revisions, user role changes, and plugin configuration edits.
- Alert on creation of new administrator accounts or REST API calls to /wp-json/wp/v2/users from non-admin sessions.
- Monitor Content Security Policy (CSP) violation reports to surface unauthorized inline script execution.
How to Mitigate CVE-2025-7498
Immediate Actions Required
- Update Exclusive Addons for Elementor to the version released in the vendor changeset 3326867 that supersedes 2.7.9.4.
- Audit all posts and pages using the Countdown Widget for injected markup and remove suspicious content.
- Rotate credentials and WordPress authentication keys if evidence of exploitation is found.
Patch Information
The vendor addressed the issue by adding input sanitization and output escaping to Countdown Widget attributes. Site administrators should upgrade the plugin to a release later than 2.7.9.4 via the WordPress plugin updater. The remediation is documented in the Wordfence Vulnerability Report.
Workarounds
- Restrict Contributor and Author roles from using the Countdown Widget by limiting Elementor editor capabilities until the patched version is deployed.
- Deploy a web application firewall rule that blocks <script>, javascript:, and on*= patterns in Elementor widget submissions.
- Enforce a strict Content Security Policy that disables inline scripts to reduce the impact of stored XSS payloads.
# Update the plugin from the WordPress CLI
wp plugin update exclusive-addons-for-elementor
wp plugin get exclusive-addons-for-elementor --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
