CVE-2025-8196: Magical Addons Elementor XSS Vulnerability

CVE-2025-8196 Overview

CVE-2025-8196 is a Stored Cross-Site Scripting (XSS) vulnerability in the Magical Addons For Elementor plugin for WordPress. The flaw affects all plugin versions up to and including 1.3.8. It stems from insufficient input sanitization and output escaping in the plugin's Custom Attributes feature. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page. The weakness is tracked as CWE-79.

Critical Impact
Authenticated contributors can store malicious JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and privileged action abuse.

Affected Products

Magical Addons For Elementor plugin for WordPress — all versions through 1.3.8
WordPress sites using the plugin's Custom Attributes feature
Any Elementor-based site where contributor-or-higher accounts can edit content

Discovery Timeline

2025-07-29 - CVE-2025-8196 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-8196

Vulnerability Analysis

The vulnerability resides in the Custom Attributes functionality of the Magical Addons For Elementor plugin. User-supplied attribute values are stored in post content and rendered back to the DOM without adequate sanitization or output escaping. An authenticated user with the contributor role or above can inject HTML event handlers or <script> payloads through attribute names or values. When any visitor loads the affected page, the browser parses the attacker-controlled markup as live script.

Stored XSS in a WordPress context is particularly useful to attackers because administrators regularly preview and edit contributor-submitted content. Payloads that fire inside an authenticated administrator session can create new administrator accounts, modify plugins, or exfiltrate authentication cookies and nonces.

Root Cause

The plugin fails to apply WordPress's standard sanitization helpers such as sanitize_text_field() on input and esc_attr() or esc_html() on output when handling Custom Attributes. The upstream fix is referenced in the WordPress Trac Changeset.

Attack Vector

Exploitation requires an authenticated session at the contributor privilege level or higher. The attacker edits an Elementor widget, adds a Custom Attribute whose name or value contains an XSS payload, and saves the page. When a reviewer, editor, or administrator loads the page in the backend or front end, the payload executes in their session context. Additional technical details are available in the Wordfence Vulnerability Report.

No verified public exploit code is available at the time of writing. The vulnerability is described in prose because no sanitized proof-of-concept has been released by the reporting researcher.

Detection Methods for CVE-2025-8196

Indicators of Compromise

Elementor page or post revisions containing attribute strings such as onmouseover=, onerror=, onclick=, or embedded <script> tags inside widget attribute fields.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after previewing contributor-submitted content.
Creation of new administrator accounts or plugin/theme file modifications shortly after a contributor-level user edited a page.

Detection Strategies

Query the wp_posts and wp_postmeta tables for Elementor data containing javascript:, on[a-z]+=, or <script substrings within custom attribute keys.
Review the WordPress audit log for contributor accounts editing pages that are subsequently viewed by administrators.
Scan Elementor JSON serialized data for HTML event handler attributes that should not appear in legitimate design elements.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that inspects POST bodies to admin-ajax.php and the Elementor editor endpoints for script payloads.
Alert on new WordPress administrator user creation and on changes to the active plugin set.
Forward WordPress and web server logs to a centralized SIEM for correlation of contributor edits with subsequent administrative actions.

How to Mitigate CVE-2025-8196

Immediate Actions Required

Update the Magical Addons For Elementor plugin to a release later than 1.3.8 that incorporates the fix from changeset 3334530.
Audit all contributor, author, and editor accounts; remove or reset accounts that are inactive or unexpected.
Review recent Elementor-authored pages for suspicious attribute values and revert affected revisions.

Patch Information

The plugin maintainer published the fix in WordPress Plugin Trac changeset 3334530. Site operators should upgrade to the first released version that contains this changeset. Refer to the plugin developer page for release notes and the Wordfence advisory for additional guidance.

Workarounds

Temporarily restrict the contributor and author roles from using the Elementor editor until the plugin is updated.
Deactivate the Magical Addons For Elementor plugin on sites that cannot be patched immediately.
Deploy a WAF rule that blocks HTML event handler attributes and <script> tags in requests to Elementor save endpoints.

bash

# Verify the installed plugin version with WP-CLI and update it
wp plugin get magical-addons-for-elementor --field=version
wp plugin update magical-addons-for-elementor

# Search the database for suspicious attribute payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%onerror=%' OR post_content LIKE '%<script%'"