CVE-2025-9203 Overview
CVE-2025-9203 is a stored Cross-Site Scripting (XSS) vulnerability in the Media Player Addons for Elementor plugin for WordPress through version 1.0.5. The flaw resides in the subtitle_ssize, track_title, and track_artist_name parameters, which lack proper input sanitization and output escaping. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who views the affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Low-privileged authenticated users can persist malicious scripts in site content, enabling session hijacking, credential theft, or redirection of site visitors and administrators.
Affected Products
- Media Player Addons for Elementor plugin for WordPress
- Versions up to and including 1.0.5
- WordPress sites running the plugin with contributor-or-above user accounts
Discovery Timeline
- 2025-09-17 - CVE-2025-9203 published to NVD
- 2026-09-26 - Last updated in NVD database
Technical Details for CVE-2025-9203
Vulnerability Analysis
The vulnerability is a stored XSS flaw affecting two Elementor widget files in the Media Player Addons plugin. User-supplied attributes passed through widget controls are rendered into page output without adequate sanitization or escaping. Because the payload is persisted inside the Elementor widget configuration, every subsequent page view triggers execution in the visitor's browser context. The affected endpoints are documented in the Wordfence advisory and in the plugin source for b_html5_addon.php and bplayer-widget-video.php.
Root Cause
The plugin accepts widget attributes including subtitle_ssize, track_title, and track_artist_name, then echoes them into HTML output without applying WordPress escaping helpers such as esc_attr() or esc_html(). There is also no server-side sanitization of these values on save using functions like sanitize_text_field(). The combination allows arbitrary HTML and <script> tags to be embedded directly in rendered markup.
Attack Vector
An authenticated attacker with contributor-level access or higher edits an Elementor page, adds the vulnerable Media Player widget, and injects a JavaScript payload into one of the affected parameter fields. When the page is published and viewed by any user, including administrators, the script executes with the privileges of the viewing session. Attackers commonly use this primitive to steal authentication cookies, perform actions on behalf of administrators, or deliver browser-based malware. For technical details on the vulnerable widget code paths, see the Wordfence Vulnerability Detail.
Detection Methods for CVE-2025-9203
Indicators of Compromise
- Elementor widget data containing <script>, onerror=, onload=, or javascript: strings in the subtitle_ssize, track_title, or track_artist_name fields.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages that embed the Media Player widget.
- New or modified posts and pages authored by contributor-level accounts that include Media Player Addons widgets.
Detection Strategies
- Query the WordPress wp_postmeta table for _elementor_data entries referencing Media Player Addons widgets and inspect them for HTML or script fragments in the three affected attributes.
- Review plugin and theme audit logs for widget edits made by contributor-level or author-level accounts.
- Deploy a web application firewall rule to flag HTTP POST requests to admin-ajax.php or Elementor save endpoints containing script tags within these parameter names.
Monitoring Recommendations
- Monitor Elementor save actions and WordPress REST API traffic to /wp-json/elementor/ endpoints for script-like payloads in widget attributes.
- Alert on contributor accounts creating or modifying published pages that embed media player widgets.
- Track Content Security Policy (CSP) violation reports to surface inline script execution on front-end pages.
How to Mitigate CVE-2025-9203
Immediate Actions Required
- Upgrade the Media Player Addons for Elementor plugin beyond version 1.0.5 as soon as a patched release is available; monitor the plugin changelog for updates.
- Audit existing Elementor pages that use Media Player Addons widgets and remove any suspicious markup from the subtitle_ssize, track_title, and track_artist_name fields.
- Review contributor, author, and editor accounts, and revoke access for any accounts that are no longer required.
Patch Information
As of the latest NVD update, the vulnerability is present in version 1.0.5. Site administrators should subscribe to the plugin's WordPress repository page and apply the vendor-released patch when published. Until then, deactivate the plugin if it is not business-critical.
Workarounds
- Deactivate the Media Player Addons for Elementor plugin on sites where it is not actively used.
- Restrict content-creation privileges by removing the contributor role from untrusted users, or require administrator review before publishing contributor submissions.
- Deploy a Content Security Policy that disallows inline scripts, and configure a WordPress WAF ruleset to block script tags submitted through Elementor widget attributes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
