CVE-2025-8874: Master Addons Elementor Plugin XSS Flaw

CVE-2025-8874 Overview

CVE-2025-8874 is a Stored Cross-Site Scripting (XSS) vulnerability in the Master Addons – Elementor Addons plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.8.6. The vulnerability stems from insufficient input sanitization and output escaping across several widgets provided by the plugin. Authenticated attackers with Contributor-level permissions or above can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who views an affected page, enabling session theft, redirection, or administrative action abuse. The vulnerability is classified under CWE-79.

Critical Impact
Authenticated contributors can store JavaScript payloads that execute against site visitors and administrators, enabling account takeover or site defacement.

Affected Products

Master Addons – Elementor Addons plugin for WordPress, versions ≤ 2.0.8.6
WordPress sites using Elementor with Master Addons widgets enabled
Sites allowing Contributor-level or higher user registration

Discovery Timeline

2025-08-12 - CVE-2025-8874 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8874

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw affecting multiple widgets exposed by the Master Addons plugin. User-supplied widget attributes are rendered into page output without adequate sanitization on input or escaping on output. An attacker with Contributor privileges or higher can construct a widget configuration containing JavaScript. The payload is persisted in the WordPress post or widget data store. When any visitor renders the affected page, the browser interprets the payload as executable script. Because the script executes in the context of the WordPress site origin, it can access cookies, perform actions on behalf of the viewer, and interact with the WordPress REST API. Administrators who preview or publish the content are at particular risk of session hijacking.

Root Cause

The root cause is missing or incomplete calls to WordPress sanitization helpers such as wp_kses_post, esc_attr, and esc_html within the widget render routines. Widget attribute values flow directly from stored post meta into HTML output. The plugin changesets 3338452 and 3340128 address the deficient escaping across the affected widgets.

Attack Vector

Exploitation requires network access to the WordPress admin interface and an authenticated account with Contributor permissions or higher. The attacker edits a post or page using the Elementor editor, selects a vulnerable Master Addons widget, and injects a crafted payload into a field such as a link, title, or HTML-bearing attribute. The payload persists through the plugin's save routine. Any subsequent viewer, including administrators reviewing draft submissions, triggers script execution. The scope change in the CVSS vector reflects that scripts cross from the vulnerable component into the browser security context of other users.

No verified public exploit code is currently available. Technical details are documented in the Wordfence Vulnerability Report and the WordPress Master Addons commit log.

Detection Methods for CVE-2025-8874

Indicators of Compromise

Post or page content containing <script>, onerror=, onload=, or javascript: strings inside Elementor widget data
Unexpected outbound requests from visitor browsers to attacker-controlled domains following page views
New administrator accounts or privilege changes shortly after Contributor-authored content is published
Modifications to WordPress options or user meta without matching administrator session activity

Detection Strategies

Query the wp_postmeta table for Elementor data entries containing script tags or JavaScript URI schemes
Monitor browser Content Security Policy (CSP) violation reports for inline script executions on pages built with Master Addons widgets
Review audit logs for Contributor-level users publishing or editing posts that reference Master Addons widget types
Correlate web server access logs with user session cookies for anomalous POST requests to admin-ajax.php originating from victim browsers

Monitoring Recommendations

Enable WordPress audit logging to track post revisions by non-administrative users
Deploy a Web Application Firewall (WAF) rule set that blocks common XSS payloads in Elementor save endpoints
Alert on sudden plugin version mismatches or disabled security plugins on the WordPress host
Capture and retain browser error telemetry from administrative sessions to identify suspicious script loads

How to Mitigate CVE-2025-8874

Immediate Actions Required

Update the Master Addons plugin to the version released after 2.0.8.6 that contains changesets 3338452 and 3340128
Audit all existing Contributor and Author accounts and remove any that are unexpected or inactive
Review posts and pages created by Contributor-level users for injected script content and purge affected revisions
Rotate administrator passwords and invalidate active sessions if the plugin was active on a publicly accessible site

Patch Information

The vendor addressed the vulnerability through WordPress plugin repository commits. Review the WordPress Changeset 3338452 and WordPress Changeset 3340128 for the applied escaping and sanitization fixes. Site operators should upgrade to the latest version available in the WordPress plugin directory.

Workarounds

Temporarily deactivate the Master Addons plugin on sites that cannot be patched immediately
Restrict post creation and editing to Editor-level users or higher until the plugin is updated
Deploy WAF rules that strip or block <script> and event-handler attributes in Elementor save requests
Enforce a strict Content Security Policy that disallows inline scripts on front-end pages

bash

# Configuration example: update plugin via WP-CLI
wp plugin update master-addons --path=/var/www/html
wp user list --role=contributor --fields=ID,user_login,user_registered