CVE-2025-8609: RTMKit Addons for Elementor XSS Vulnerability

CVE-2025-8609 Overview

CVE-2025-8609 is a Stored Cross-Site Scripting (XSS) vulnerability in the RTMKit Addons for Elementor plugin for WordPress. The flaw affects all versions up to and including 1.6.1. It resides in the plugin's Accordion Block, where user-supplied attributes are not properly sanitized or escaped on output. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any visitor who loads the affected page. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Contributor-level attackers can persist malicious JavaScript in WordPress pages, enabling session theft, administrative account compromise, and drive-by redirects against site visitors.

Affected Products

RTMKit Addons for Elementor (Rometheme for Elementor) plugin for WordPress
All versions up to and including 1.6.1
Affected component: rkit_image_accordion.php (Accordion Block widget)

Discovery Timeline

2025-11-18 - CVE-2025-8609 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8609

Vulnerability Analysis

The vulnerability exists in the Accordion Block widget of the RTMKit Addons for Elementor plugin. The widget accepts attributes supplied by page authors and renders them directly into HTML output. Because the plugin lacks input sanitization on write and output escaping on render, attacker-controlled attribute values are echoed into the DOM verbatim. Any script payload embedded in these attributes executes when a visitor loads the affected page.

Exploitation requires an authenticated session at contributor level or higher. WordPress contributors can create and edit their own posts but cannot publish them. However, once a stored payload is inserted into content that an editor or administrator reviews or later publishes, the script executes in their authenticated browser context. This creates a path from low-privilege user to full site takeover.

Root Cause

The root cause is missing sanitization on attribute intake and missing output escaping in the widget's render path within rkit_image_accordion.php. The plugin trusts author-supplied values instead of applying WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses_post() at output.

Attack Vector

The attack requires network access to the WordPress admin interface and an authenticated contributor account. The attacker crafts an Elementor page or block containing an Accordion widget with malicious attribute values embedding JavaScript. The payload persists in the database. When any user, including administrators, previews or visits the page, the script executes with the visitor's privileges and origin.

No verified proof-of-concept code is publicly available. For technical details on the vulnerable code path, refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-8609

Indicators of Compromise

Elementor page or post revisions containing <script> tags, javascript: URIs, or event handlers such as onerror= and onload= inside Accordion Block attributes.
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages using the RTMKit Accordion widget.
New or modified administrator accounts created shortly after a contributor account edited a page containing an Accordion Block.
Presence of the RTMKit Addons for Elementor plugin at version 1.6.1 or earlier.

Detection Strategies

Query the wp_posts and wp_postmeta tables for Elementor JSON data containing script tags or event-handler attributes within rkit_image_accordion widget blocks.
Deploy a Web Application Firewall (WAF) rule to inspect POST bodies to /wp-admin/admin-ajax.php for script payloads bound to Elementor accordion attribute fields.
Enable WordPress audit logging to correlate contributor edits with subsequent script execution telemetry from visitor sessions.

Monitoring Recommendations

Monitor WordPress plugin inventory and flag any site running RTMKit Addons for Elementor at version 1.6.1 or earlier.
Alert on privilege escalation events, especially new administrator accounts or role changes following contributor page edits.
Track browser Content Security Policy (CSP) violation reports for inline script executions on pages rendered by the plugin.

How to Mitigate CVE-2025-8609

Immediate Actions Required

Update the RTMKit Addons for Elementor plugin to the version released in changeset 3369481, which is later than 1.6.1.
Audit all existing Accordion Block content for injected scripts and remove malicious payloads from post content and revisions.
Review contributor and author accounts for signs of compromise, and reset credentials for any suspicious accounts.
Rotate WordPress administrator passwords and invalidate active sessions if injected payloads may have been triggered.

Patch Information

The vendor addressed the vulnerability in the plugin update tracked by WordPress Plugin Changeset 3369481. The fix adds proper sanitization and output escaping to the Accordion Block attributes in rkit_image_accordion.php. Site operators should upgrade to the latest available version through the WordPress plugin dashboard.

Workarounds

Disable and deactivate the RTMKit Addons for Elementor plugin until it is updated to a patched version.
Restrict contributor and author role assignments to trusted users only, and require multi-factor authentication for all authenticated WordPress roles.
Enforce a strict Content Security Policy that blocks inline scripts and untrusted external script sources to reduce XSS impact.
Deploy a managed WordPress WAF configured to block script payloads submitted through Elementor widget attribute fields.

bash

# Example: enumerate WordPress installs running the vulnerable plugin version
wp plugin list --path=/var/www/html --format=csv \
  | awk -F, '$1=="rometheme-for-elementor" && $4<="1.6.1" {print}'

# Example: strict CSP header in nginx to mitigate reflected/stored XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;