CVE-2025-8779: Elementor WidgetKit XSS Vulnerability

CVE-2025-8779 Overview

CVE-2025-8779 is a Stored Cross-Site Scripting (XSS) vulnerability in the All-in-One Addons for Elementor – WidgetKit plugin for WordPress. The flaw affects all versions up to and including 2.5.6. Insufficient input sanitization and output escaping in the plugin's Team and Countdown widgets allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. Injected scripts execute in the browser of any user who accesses an affected page. The issue is classified under CWE-79.

Critical Impact
Authenticated contributors can persist JavaScript payloads on WordPress pages, enabling session theft, administrative account takeover, and drive-by redirection against site visitors and editors.

Affected Products

All-in-One Addons for Elementor – WidgetKit plugin for WordPress
Versions 2.5.6 and earlier
WordPress sites using the plugin's Team widget or Countdown widget

Discovery Timeline

2025-12-13 - CVE-2025-8779 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8779

Vulnerability Analysis

The vulnerability resides in the rendering paths for two WidgetKit components: the Team widget and the Countdown widget. Both widgets accept user-supplied attributes and emit them into page markup without adequate sanitization or output escaping. An authenticated user with contributor privileges can supply attribute values containing HTML or JavaScript. When an editor previews the post or a visitor loads the published page, the injected payload executes in the victim's browser session.

Because the payload is stored in the WordPress database, exploitation is persistent. Each page view triggers the script. The scope change to a different security context (S:C in the CVSS vector) reflects that scripts running in an administrator's browser can reach resources beyond the initial vulnerable component, including the WordPress admin dashboard.

Root Cause

The underlying defect is a failure to apply WordPress escaping primitives such as esc_attr(), esc_html(), or wp_kses_post() to user-controlled widget attributes before rendering. The Team and Countdown widgets trust contributor input and concatenate it directly into HTML output, producing a classic stored XSS sink [CWE-79].

Attack Vector

Exploitation requires an authenticated account at contributor level or above. The attacker creates or edits a post that embeds the WidgetKit Team or Countdown widget and supplies malicious values in the affected attribute fields. Once the content is saved, the payload persists. When any user, including higher-privileged editors or administrators, views the page, the JavaScript executes with the victim's session context. This can be chained to escalate privileges by hijacking administrator cookies or forging authenticated requests. See the Wordfence Vulnerability Report for additional detail.

No verified public exploit code is available. The vulnerability is described in prose only.

Detection Methods for CVE-2025-8779

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored in WordPress postmeta rows tied to WidgetKit widgets
New or modified posts authored by contributor-level accounts that embed Team or Countdown widgets
Administrator sessions initiating unusual REST API calls (for example, user creation) immediately after viewing a page containing the widgets
Outbound browser connections from editor workstations to unfamiliar domains after opening plugin-rendered content

Detection Strategies

Query the wp_posts and wp_postmeta tables for widget attribute values containing HTML event handlers or script tags
Enable WordPress audit logging to record post edits by contributor and author roles
Deploy Content Security Policy (CSP) reporting to surface inline script violations originating from plugin-rendered pages
Review the WordPress Plugin Changeset to identify the specific sanitization changes and match forensic artifacts

Monitoring Recommendations

Monitor administrator browser sessions for anomalous DOM activity when previewing contributor-submitted content
Alert on privilege changes, plugin installations, or new administrative accounts created shortly after editor page views
Track file integrity on the wp-content/plugins/widgetkit-for-elementor/ directory to confirm patch application

How to Mitigate CVE-2025-8779

Immediate Actions Required

Update the All-in-One Addons for Elementor – WidgetKit plugin to a version newer than 2.5.6 as soon as the vendor publishes a fixed release
Audit contributor and author accounts and remove untrusted or dormant users
Review all existing pages that use the Team or Countdown widgets for injected script content and remove malicious attributes
Force password resets and invalidate active sessions for administrative accounts that may have viewed compromised pages

Patch Information

Refer to the WordPress Plugin Changeset and the WidgetKit for Elementor plugin page for the latest release information. The fix applies proper sanitization and output escaping to the affected widget attributes.

Workarounds

Restrict contributor and author role assignments until the plugin is patched
Temporarily disable the WidgetKit plugin if the Team and Countdown widgets are not required
Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript event handlers in WidgetKit widget parameters
Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin

bash

# Example: disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate widgetkit-for-elementor

# Search the database for suspicious widget attribute payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%widgetkit%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"