CVE-2025-1261

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1261", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-12T20:06:58.478Z", "datePublished": "2025-03-08T01:44:27.321Z", "dateUpdated": "2026-04-08T17:29:50.857Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:50.857Z"}, "affected": [{"vendor": "devitemsllc", "product": "HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The HT Mega \u2013 Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability exists due to an incomplete fix for CVE-2024-3307."}], "title": "HT Mega \u2013 Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e553135d-88e0-4840-99ad-9514c2243b7d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3249106/ht-mega-for-elementor/tags/2.8.3/assets/js/htmega-widgets-active.js"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-02-12T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-03-07T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T16:06:29.659557Z", "id": "CVE-2025-1261", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T16:06:36.504Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1261", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T16:06:29.659557Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T16:06:33.268Z"}}], "cna": {"title": "HT Mega \u2013 Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "devitemsllc", "product": "HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.8.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-12T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-03-07T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e553135d-88e0-4840-99ad-9514c2243b7d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3249106/ht-mega-for-elementor/tags/2.8.3/assets/js/htmega-widgets-active.js"}], "descriptions": [{"lang": "en", "value": "The HT Mega \u2013 Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability exists due to an incomplete fix for CVE-2024-3307."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:50.857Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1261", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:50.857Z", "dateReserved": "2025-02-12T20:06:58.478Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-08T01:44:27.321Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder", "vendor": "devitemsllc", "versions": [{"lessThanOrEqual": "2.8.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hasthemes:ht_mega:*:*:*:*:free:wordpress:*:*", "matchCriteriaId": "A612198B-D893-4691-B75A-02E261CC4250", "versionEndIncluding": "2.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The HT Mega \u2013 Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability exists due to an incomplete fix for CVE-2024-3307."}, {"lang": "es", "value": "El complemento HT Mega \u2013 Absolute Addons For Elementor para WordPress es vulnerable a cross site scripting almacenado basadas en DOM a trav\u00e9s del widget Countdown del complemento en todas las versiones hasta la 2.8.2 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. NOTA: Esta vulnerabilidad existe debido a una correcci\u00f3n incompleta de CVE-2024-3307."}], "id": "CVE-2025-1261", "lastModified": "2026-06-17T08:38:41.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1261", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-10T16:06:29.659557Z", "version": "2.0.3"}}]}, "published": "2025-03-08T02:15:34.147", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3249106/ht-mega-for-elementor/tags/2.8.3/assets/js/htmega-widgets-active.js"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e553135d-88e0-4840-99ad-9514c2243b7d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:03:38.547405+00:00", "value": {"mitigation_remediation": ["Upgrade HT\u202fMega to version\u202f2.8.3 or later, where the Countdown widget is fixed", "If an upgrade is not immediately possible, disable or remove the Countdown widget from all templates and pages to eliminate the injection surface", "Restrict Contributor and higher roles to only the sites and content where they are truly required, limiting the number of accounts that can inject scripts via the widget"], "summary": {"action": "Patch", "impact": "Stored XSS via the Countdown widget allowing injection of arbitrary scripts that run for any page visitor"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the HT Mega Addons for Elementor \u2013 Elementor Widgets & Template Builder plugin by devitemsllc. All versions up to and including 2.8.2 are vulnerable; version 2.8.3 and later contain the fix.", "description_and_impact": "The HT Mega \u2013 Absolute Addons For Elementor plugin contains a DOM\u2011based stored cross\u2011site scripting flaw in its Countdown widget. User\u2011supplied attributes are not sanitized, allowing a contributor\u2011level attacker to inject JavaScript that is stored with the page. When any visitor loads the affected page, the script runs in the visitor\u2019s browser. The description does not state specific downstream effects; based on common XSS outcomes, one could infer that an attacker might steal information or deface the site, but these results are not explicitly documented here.", "risk_and_exploitability": "The CVSS score of 6.4 indicates medium severity, and the EPSS score of less than 1\u202f% implies a low probability of exploitation in the wild. Because the flaw requires authenticated contributor-level access to inject the payload, an attacker must first obtain that role or compromise an account with it, then the stored script is delivered to every user who opens the page. The vulnerability is not yet listed in the CISA KEV catalog."}}}}, "created": "2026-04-21T22:15:45.896432+00:00", "updated": "2026-04-21T22:15:45.896443+00:00", "vendors": []}