CVE-2025-8212: Medical Addon for Elementor XSS Vulnerability

CVE-2025-8212 is a stored cross-site scripting flaw in the Medical Addon for Elementor WordPress plugin affecting versions up to 1.6.4. Attackers with contributor access can inject malicious scripts. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-8212 Overview

CVE-2025-8212 is a Stored Cross-Site Scripting (XSS) vulnerability in the Medical Addon for Elementor plugin for WordPress. The flaw exists in the plugin's Typewriter widget in all versions up to and including 1.6.4. The root cause is insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or above can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who views the affected page, enabling session theft, redirection, or further client-side attacks against site visitors and administrators.

Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that execute against any visitor, including administrators, enabling account takeover and site compromise.

Affected Products

Medical Addon for Elementor plugin for WordPress
All versions up to and including 1.6.4
Sites using the plugin's Typewriter widget

Discovery Timeline

2025-08-02 - CVE-2025-8212 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8212

Vulnerability Analysis

The vulnerability is a stored Cross-Site Scripting flaw [CWE-79] in the Typewriter widget shipped with the Medical Addon for Elementor plugin. The widget accepts user-controlled attributes but fails to sanitize input before storage and does not escape output when rendering content on the frontend. As a result, HTML and JavaScript supplied through widget attributes are rendered verbatim in the Document Object Model (DOM).

Because the payload is stored in the WordPress database as part of the page or post content, every visitor to the affected page triggers execution. The attack scope changes from the attacker's authenticated session to any viewer's session, which includes editors and administrators browsing the site.

Root Cause

The Typewriter widget rendering logic does not apply WordPress sanitization helpers such as wp_kses_post() on input, nor does it apply esc_html() or esc_attr() on output. Attribute values provided during Elementor page editing are concatenated directly into the rendered markup, allowing script contexts to be reached.

Attack Vector

An authenticated user with contributor privileges or higher edits a page using Elementor and inserts the Typewriter widget. The attacker supplies a payload within one of the widget's text attributes. Once the page is published or previewed, the stored payload runs in the context of the WordPress site's origin whenever an authenticated administrator or anonymous visitor loads the page.

No verified exploit code is public. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the patched code paths.

Detection Methods for CVE-2025-8212

Indicators of Compromise

Unexpected <script> tags, on* event handlers, or javascript: URIs stored in wp_posts.post_content for pages built with Elementor.
Outbound requests from site visitors to attacker-controlled domains originating from rendered pages.
Newly created administrator accounts or modified user roles following page edits by contributor-level users.

Detection Strategies

Scan the WordPress database for suspicious strings in Elementor widget data, particularly within Typewriter widget attribute fields serialized under _elementor_data postmeta.
Review audit logs for contributor or author accounts that recently added or modified pages containing the Typewriter widget.
Monitor the browser Content Security Policy (CSP) violation reports for inline script executions on affected pages.

Monitoring Recommendations

Enable WordPress activity logging to track post edits, user role changes, and plugin configuration updates.
Alert on administrator session anomalies such as unexpected cookie exfiltration or unusual admin-ajax.php requests following page views.
Track plugin version inventory across managed WordPress sites and flag installations of Medical Addon for Elementor at version 1.6.4 or earlier.

How to Mitigate CVE-2025-8212

Immediate Actions Required

Update the Medical Addon for Elementor plugin to a version later than 1.6.4 as soon as the vendor publishes a fixed release.
Audit all pages that use the Typewriter widget and remove any suspicious attribute content inserted by contributor-level accounts.
Review and reduce contributor and author account privileges, and reset credentials for any account suspected of abuse.

Patch Information

Refer to the WordPress Plugin Changeset for the committed fix and consult the Medical Addon for Elementor plugin page for the latest release notes. The Wordfence Vulnerability Report tracks fixed versions.

Workarounds

Disable the Medical Addon for Elementor plugin on affected sites until an updated version is installed.
Restrict page editing capabilities so that only trusted editor or administrator accounts can publish Elementor-built content.
Deploy a Web Application Firewall (WAF) rule that blocks requests containing script payloads in Elementor widget attributes.

bash

# Configuration example: deactivate the plugin via WP-CLI pending a patched release
wp plugin deactivate medical-addon-for-elementor

# Audit Typewriter widget usage across posts and pages
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%typewriter%' OR ID IN (SELECT post_id FROM wp_postmeta WHERE meta_key='_elementor_data' AND meta_value LIKE '%typewriter%');"