CVE-2025-8200: Mega Elements Elementor Plugin XSS Vulnerability

CVE-2025-8200 Overview

CVE-2025-8200 is a stored Cross-Site Scripting (XSS) vulnerability in the Mega Elements – Addons for Elementor plugin for WordPress. The flaw resides in the plugin's Countdown Timer widget and affects all versions up to and including 1.3.2. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or above to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who views an affected page. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist JavaScript payloads in Countdown Timer widget attributes, enabling session theft, administrative action abuse, and site defacement.

Affected Products

Mega Elements – Addons for Elementor plugin for WordPress
All versions up to and including 1.3.2
Countdown Timer widget component

Discovery Timeline

2025-09-26 - CVE-2025-8200 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8200

Vulnerability Analysis

The vulnerability is a stored XSS flaw introduced through the plugin's Countdown Timer widget. The widget accepts user-supplied attributes that flow into rendered HTML without adequate sanitization or output escaping. An authenticated user with contributor privileges or higher can craft widget attributes containing JavaScript payloads. When the affected page or post is rendered, the browser parses and executes the injected script in the context of the visiting user's session.

Successful exploitation permits actions available to the victim, including administrative operations if an administrator visits the page. Common outcomes include cookie theft, forced navigation, drive-by download initiation, and creation of new privileged accounts through forged requests.

Root Cause

The root cause is missing input sanitization on widget attributes and missing output escaping when those attributes are rendered into the page HTML. WordPress provides functions such as sanitize_text_field(), wp_kses_post(), and esc_attr() for these purposes. The vulnerable widget passes attacker-controlled data directly into the DOM without applying them, violating standard WordPress secure coding guidance.

Attack Vector

Exploitation requires an authenticated account at the contributor level or higher on a WordPress site running the vulnerable plugin. The attacker inserts a Countdown Timer widget into a post or page and supplies a malicious value in one of the widget's attribute fields. The stored payload executes whenever any user, authenticated or anonymous, loads a page containing the widget. The scope is changed (S:C) because the injected script runs in the browser origin of any visitor, not just the attacker.

Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-8200

Indicators of Compromise

Countdown Timer widget attributes containing <script>, onerror=, onload=, or javascript: strings in wp_postmeta or serialized Elementor data.
Unexpected outbound requests from visitor browsers to attacker-controlled domains after page loads.
Creation of new administrator accounts or modification of user roles shortly after content edits by contributor accounts.
Elementor page data referencing the mega-elements Countdown Timer widget with encoded payloads such as \\u003cscript\\u003e.

Detection Strategies

Audit all posts and pages using the Countdown Timer widget for suspicious attribute values by querying wp_postmeta for the _elementor_data key.
Review contributor and author activity logs for unusual post creation or edit patterns that coincide with widget usage.
Deploy a web application firewall rule to inspect POST requests to /wp-admin/admin-ajax.php containing Elementor widget data with script-related tokens.
Monitor browser Content Security Policy (CSP) violation reports for inline script executions on public pages.

Monitoring Recommendations

Enable WordPress audit logging to capture post revisions and widget attribute changes performed by non-administrator roles.
Alert on newly created privileged users, plugin installations, or theme edits following contributor-level content changes.
Track HTTP responses containing unescaped script tags originating from Elementor-rendered pages.

How to Mitigate CVE-2025-8200

Immediate Actions Required

Update the Mega Elements – Addons for Elementor plugin to a version later than 1.3.2 once available from the vendor.
Review all existing pages containing Countdown Timer widgets and remove any suspicious attribute content.
Restrict contributor and author account creation, and audit existing low-privilege accounts for legitimacy.
Rotate WordPress administrator credentials and session tokens if malicious widget content is discovered.

Patch Information

Monitor the WordPress Plugin Changeset Update and the WordPress Mega Elements Plugin page for the patched release addressing this issue. Apply the update through the WordPress plugin manager or by replacing plugin files manually.

Workarounds

Temporarily deactivate the Mega Elements – Addons for Elementor plugin until a patched version is installed.
Remove or disable the Countdown Timer widget from the Elementor editor for contributor and author roles.
Restrict content publishing to trusted editor and administrator roles by revoking edit_posts capability from untrusted contributors.
Deploy a Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.

bash

# Configuration example: remove contributor publishing capability via WP-CLI
wp cap remove contributor edit_posts
wp cap remove contributor delete_posts

# Disable the vulnerable plugin site-wide until patched
wp plugin deactivate mega-elements-addons-for-elementor