CVE-2025-12537

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12537", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T20:28:28.177Z", "datePublished": "2025-12-14T05:21:18.516Z", "dateUpdated": "2026-04-08T17:09:48.640Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:48.640Z"}, "affected": [{"vendor": "wpvibes", "product": "Addon Elements for Elementor (formerly Elementor Addon Elements)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.14.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to insufficient input sanitization and output escaping on multiple widget parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via multiple widget parameters in pages that will execute whenever a user accesses an injected page."}], "title": "Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94217d06-21c2-443d-ae2c-a2dbd65b7908?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3415227/addon-elements-for-elementor-page-builder/trunk/assets/js/eae.js"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-10-21T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-04T08:27:47.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-13T16:57:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:42:40.412603Z", "id": "CVE-2025-12537", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:45:55.174Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12537", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:42:40.412603Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:42:41.493Z"}}], "cna": {"title": "Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpvibes", "product": "Addon Elements for Elementor (formerly Elementor Addon Elements)", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.14.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-21T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-04T08:27:47.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-13T16:57:04.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94217d06-21c2-443d-ae2c-a2dbd65b7908?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3415227/addon-elements-for-elementor-page-builder/trunk/assets/js/eae.js"}], "descriptions": [{"lang": "en", "value": "The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to insufficient input sanitization and output escaping on multiple widget parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via multiple widget parameters in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-14T05:21:18.516Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12537", "state": "PUBLISHED", "dateUpdated": "2025-12-15T15:45:55.174Z", "dateReserved": "2025-10-30T20:28:28.177Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-14T05:21:18.516Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Addon Elements for Elementor (formerly Elementor Addon Elements)", "vendor": "wpvibes", "versions": [{"lessThanOrEqual": "1.14.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to insufficient input sanitization and output escaping on multiple widget parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via multiple widget parameters in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Addon Elements for Elementor para WordPress es vulnerable a cross-site scripting almacenado en todas las versiones hasta la 1.14.3, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida en m\u00faltiples par\u00e1metros de widget. Esto permite que atacantes autenticados, con acceso de nivel Colaborador o superior, inyecten scripts web arbitrarios a trav\u00e9s de m\u00faltiples par\u00e1metros de widget en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-12537", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12537", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:42:40.412603Z", "version": "2.0.3"}}]}, "published": "2025-12-14T06:15:36.410", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3415227/addon-elements-for-elementor-page-builder/trunk/assets/js/eae.js"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94217d06-21c2-443d-ae2c-a2dbd65b7908?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:07:52.966669+00:00", "value": {"mitigation_remediation": ["Obtain and apply the latest patch or new release of the Addon Elements for Elementor plugin that removes the vulnerable code paths.", "If an update is not yet available, eliminate or sanitize all widget parameters that allow arbitrary HTML content in pages edited by Contributors.", "Restrict or monitor Contributor permissions so that only trusted users can create or modify page widgets.", "Implement a Content Security Policy that blocks inline scripts unless specifically allowed to mitigate the impact of any residual XSS.", "Regularly audit page content for unexpected script tags or malicious elements inserted by old widgets."], "summary": {"action": "Assess Impact", "impact": "Stored cross-site scripting"}, "threat_synthesis": {"affected_systems": "The affected product is the Addon Elements for Elementor WordPress plugin, distributed by wpvibes (formerly Elementor Addon Elements). All releases up to and including version 1.14.3 are vulnerable; later versions have fixed the issue.", "description_and_impact": "The vulnerability is a stored cross-site scripting flaw that allows authenticated users with Contributor permissions or higher to inject malicious JavaScript into widget parameters of pages created with the plugin. The injected scripts execute automatically when any user loads the page, enabling an attacker to hijack user sessions, deface content, or modify site behavior. The weakness is a classic input validation and output escaping failure, classified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication and works via normal page editing workflows, making it feasible for any user with Contributor-level access to craft malicious widgets that later execute for all visitors."}}}}, "created": "2025-12-15T14:05:49.231386+00:00", "updated": "2026-04-21T17:15:25.334288+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "wordpress", "wordpress$PRODUCT$wordpress", "wpvibes", "wpvibes$PRODUCT$elementor_addon_elements"]}