CVE-2025-9045: Easy Elementor Addons XSS Vulnerability

CVE-2025-9045 Overview

CVE-2025-9045 is a stored Cross-Site Scripting (XSS) vulnerability in the Easy Elementor Addons plugin for WordPress. The flaw affects all versions up to and including 2.2.9. The plugin fails to properly sanitize input and escape output for several widget parameters, including those in the Countdown and Image Comparison modules.

Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits an affected page. This vulnerability is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level accounts can inject persistent JavaScript that executes against administrators and site visitors, enabling session theft, account takeover, and redirection to attacker-controlled infrastructure.

Affected Products

Easy Elementor Addons plugin for WordPress, versions ≤ 2.2.9
Countdown widget module (modules/countdown/widgets/countdown.php)
Image Comparison widget module (modules/image-comparison/widgets/image-comparison.php)

Discovery Timeline

2025-10-03 - CVE-2025-9045 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9045

Vulnerability Analysis

The vulnerability resides in widget rendering logic that accepts user-controlled parameters and outputs them to page markup without sufficient escaping. According to the Wordfence Vulnerability Report, multiple widget parameters are affected across the Countdown and Image Comparison modules.

Exploitation requires an authenticated WordPress session with contributor privileges or higher. Contributor is a low-trust role available to anyone permitted to draft content on the site. Once payloads are stored in post or page metadata, they execute for every subsequent viewer, including administrators previewing or editing the affected content.

Because the scope changes from the attacker's context to the victim's browser session, a low-privileged contributor can effectively pivot to administrator-level actions via CSRF or DOM-based token theft.

Root Cause

The plugin renders widget attributes such as countdown labels and image comparison captions directly into HTML without applying WordPress escape functions like esc_html(), esc_attr(), or wp_kses_post(). The vulnerable sinks are located at specific lines in countdown.php (lines 864, 868, 871) and image-comparison.php (lines 376, 377) of the 2.2.8 tag, as documented in the WordPress plugin repository.

Attack Vector

An attacker with a contributor account creates or edits a page using an affected Elementor widget. The attacker supplies a payload containing script tags or event handlers in a widget parameter such as a countdown label or comparison caption. The payload is saved to the database and rendered on the published page. When any authenticated or anonymous user visits the page, the script executes in their browser context, enabling cookie theft, forced administrator actions, or redirection.

The vulnerability requires no user interaction beyond visiting the injected page and can be triggered remotely over the network.

Detection Methods for CVE-2025-9045

Indicators of Compromise

Post or page metadata containing <script>, javascript:, or event handler strings such as onerror= and onload= in Easy Elementor Addons widget fields
Unexpected outbound requests from administrator browsers to unfamiliar domains after visiting content pages
Newly created WordPress administrator accounts or role changes that correlate with contributor activity
Anomalous edits to pages by contributor accounts that include Countdown or Image Comparison widgets

Detection Strategies

Audit the wp_postmeta table for Elementor data entries containing HTML tags or JavaScript URI schemes within widget parameters
Deploy web application firewall rules that inspect POST requests to /wp-admin/admin-ajax.php for Elementor save operations containing script payloads
Correlate contributor role activity with subsequent administrator session anomalies through SIEM analytics

Monitoring Recommendations

Enable WordPress activity logging to capture all page and widget edits performed by contributor and author roles
Monitor browser telemetry from administrator endpoints for unexpected script execution or credential prompts
Alert on creation of new privileged accounts or plugin installations within short windows after contributor content edits

How to Mitigate CVE-2025-9045

Immediate Actions Required

Update the Easy Elementor Addons plugin to version 2.3.0 or later on all WordPress installations
Review all pages containing Countdown or Image Comparison widgets for injected script content and purge malicious payloads
Audit contributor and author accounts, disabling any that are unused or unrecognized
Force password resets for all administrator accounts and rotate WordPress authentication salts in wp-config.php

Patch Information

The vendor addressed the vulnerability in Easy Elementor Addons version 2.3.0. The fix adds proper escaping to the previously vulnerable widget parameters in countdown.php and image-comparison.php, as visible in the patched countdown.php and patched image-comparison.php source files.

Workarounds

Restrict contributor and author role assignments to trusted users only until patching is complete
Temporarily disable the Easy Elementor Addons plugin if immediate patching is not possible
Deploy a WAF with XSS filtering rules to block script payloads in Elementor widget save requests
Enforce a strict Content Security Policy that disallows inline script execution on the WordPress site

bash

# Update the plugin via WP-CLI
wp plugin update easy-elementor-addons --version=2.3.0

# Verify installed version
wp plugin get easy-elementor-addons --field=version

# Audit contributor and author accounts
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered
wp user list --role=author --fields=ID,user_login,user_email,user_registered