CVE-2025-0433

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0433", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-13T21:59:30.426Z", "datePublished": "2025-03-04T08:23:42.853Z", "dateUpdated": "2026-04-08T17:21:13.900Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:13.900Z"}, "affected": [{"vendor": "litonice13", "product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder & Template Kits", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.7.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Master Addons \u2013 Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018id\u2019 parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c693831f-fe60-4548-83aa-4ebd03d134ec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-tabs/ma-tabs.php#L568"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-image-hover-effects/ma-image-hover-effects.php#L1117"}, {"url": "https://wordpress.org/plugins/master-addons/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3243199/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-03-03T19:57:54.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-04T14:22:46.585434Z", "id": "CVE-2025-0433", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T14:23:01.283Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0433", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-04T14:22:46.585434Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T14:22:54.304Z"}}], "cna": {"title": "Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "litonice13", "product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder & Template Kits", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.7.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-03T19:57:54.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c693831f-fe60-4548-83aa-4ebd03d134ec?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-tabs/ma-tabs.php#L568"}, {"url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-image-hover-effects/ma-image-hover-effects.php#L1117"}, {"url": "https://wordpress.org/plugins/master-addons/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3243199/"}], "descriptions": [{"lang": "en", "value": "The Master Addons \u2013 Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018id\u2019 parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:13.900Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0433", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:13.900Z", "dateReserved": "2025-01-13T21:59:30.426Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-04T08:23:42.853Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder & Template Kits", "vendor": "litonice13", "versions": [{"lessThanOrEqual": "2.0.7.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:master-addons:master_addons:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "20BAE878-97CC-4F70-912A-CFA688358CC7", "versionEndExcluding": "2.0.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Master Addons \u2013 Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018id\u2019 parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Master Addons \u2013 Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, &amp; Animations para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'id' en todas las versiones hasta la 2.0.7.1 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten secuencias de comandos web arbitrarias en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-0433", "lastModified": "2026-06-17T08:26:28.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0433", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-04T14:22:46.585434Z", "version": "2.0.3"}}]}, "published": "2025-03-04T09:15:10.613", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-image-hover-effects/ma-image-hover-effects.php#L1117"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/master-addons/trunk/addons/ma-tabs/ma-tabs.php#L568"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3243199/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/master-addons/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c693831f-fe60-4548-83aa-4ebd03d134ec?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:07:06.564247+00:00", "value": {"mitigation_remediation": ["Update Master Addons to a version newer than 2.0.7.1 before the plugin is applied to production sites", "If an immediate update is not possible, remove Contributor or higher roles from users that will not need access to the plugin, or restrict these roles from using the plugin via role\u2011based access control", "As an interim workaround, disable the plugin\u2019s features that rely on the \u2018id\u2019 parameter or use a content filtering plugin to sanitize output from the affected components"], "summary": {"action": "Apply Update", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Affected are all installations of Master Addons For Elementor \u2013 Widgets, Extensions, Theme Builder, Popup Builder & Template Kits up to and including version 2.0.7.1. Users running any of these versions on WordPress should verify their installed version against the latest release.\n", "description_and_impact": "The Master Addons \u2013 Elementor Addons plugin for WordPress contains a stored cross\u2011site scripting vulnerability that allows an authenticated user with Contributor-level access or higher to inject arbitrary JavaScript through the unfiltered \u2018id\u2019 parameter in several plugin components. When the data is persisted and subsequently displayed on a page, the malicious script runs under the identity of the visitor, enabling attackers to steal session data, deface content, or perform further phishing attempts against site users. The weakness arises from insufficient input sanitization and lack of output escaping, which directly maps to CWE\u201179.\n", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.4, indicating moderate severity. The EPSS score is below 1\u202f%, suggesting a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Nonetheless, because the flaw requires only Contributor\u2011level access, sites with such roles or higher are susceptible. An attacker can exploit the stored XSS by interacting with the plugin\u2019s UI to submit data containing malicious scripts, which will persist and execute when the infected page is rendered for any user. No additional external conditions are required beyond the authentication level.\n"}}}}, "created": "2026-04-21T22:15:45.901559+00:00", "updated": "2026-04-21T22:15:45.901571+00:00", "vendors": []}