CVE-2025-7960

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7960", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-21T14:56:56.963Z", "datePublished": "2025-12-13T08:21:13.187Z", "dateUpdated": "2026-04-08T16:54:24.380Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:24.380Z"}, "affected": [{"vendor": "kingaddons", "product": "King Addons for Elementor \u2013 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "51.1.39", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Slider, Pricing Calculator, and Image Accordion widgets in all versions up to, and including, 51.1.39 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "King Addons for Elementor <= 51.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57865837-470e-4afd-bb90-d203a78a210b?source=cve"}, {"url": "https://wordpress.org/plugins/king-addons/#developers"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-12-12T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:42:56.499454Z", "id": "CVE-2025-7960", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:46:37.457Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7960", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:42:56.499454Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:42:58.129Z"}}], "cna": {"title": "King Addons for Elementor <= 51.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "kingaddons", "product": "King Addons for Elementor \u2013 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "51.1.39"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57865837-470e-4afd-bb90-d203a78a210b?source=cve"}, {"url": "https://wordpress.org/plugins/king-addons/#developers"}], "descriptions": [{"lang": "en", "value": "The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Slider, Pricing Calculator, and Image Accordion widgets in all versions up to, and including, 51.1.39 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-13T08:21:13.187Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7960", "state": "PUBLISHED", "dateUpdated": "2025-12-15T15:46:37.457Z", "dateReserved": "2025-07-21T14:56:56.963Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T08:21:13.187Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "King Addons for Elementor \u2013 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder", "vendor": "kingaddons", "versions": [{"lessThanOrEqual": "51.1.39", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Slider, Pricing Calculator, and Image Accordion widgets in all versions up to, and including, 51.1.39 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin King Addons para Elementor para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los widgets Pricing Slider, Pricing Calculator e Image Accordion del plugin en todas las versiones hasta la 51.1.39, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-7960", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7960", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:42:56.499454Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:55.643", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/king-addons/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57865837-470e-4afd-bb90-d203a78a210b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:45:57.573958+00:00", "value": {"mitigation_remediation": ["Upgrade King Addons for Elementor to version 51.1.40 or newer to fix the XSS flaw.", "If an upgrade is not immediately feasible, disable or remove the Pricing Slider, Pricing Calculator, and Image Accordion widgets from the site to eliminate the attack surface.", "Restrict contributor\u2011level or higher WordPress user roles until the patch is applied.", "Implement a web application firewall rule that blocks suspicious XSS payloads from widget content."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting via Authenticated Contributor Access"}, "threat_synthesis": {"affected_systems": "All releases of the King Addons for Elementor WordPress plugin on the WordPress plugin repository through version 51.1.39 are affected. The vulnerability occurs in the plugin\u2019s Pricing Slider, Pricing Calculator, and Image Accordion widgets, which are part of the King Addons for Elementor suite that offers more than 80 Elementor widgets, thousands of templates, and integrated WooCommerce enhancements.", "description_and_impact": "The plugin allows full control over widget configurations. In versions up to and including 51.1.39 the widget attributes are taken from user input without proper sanitization or output escaping, permitting an authenticated contributor or higher to embed arbitrary JavaScript directly into the widget markup. When a visitor loads a page that contains the modified widget, the injected script executes in that visitor's browser, exposing the site to flash\u2011pharming, cookie theft, or malicious redirection. This vulnerability corresponds to CWE\u201179 and delivers the attacker control over client\u2011side code while bypassing the site's content security mechanisms, thereby compromising confidentiality, integrity, and availability of the web interface for end users.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium impact for an attacker who already has contributor rights on the WordPress installation. EPSS of less than 1% shows that, so far, the vulnerability has not seen widespread exploitation. It is not currently in the CISA KEV catalog. Because the flaw requires authenticated access, an attacker must first obtain contributor or higher privileges, after which the vulnerability can be leveraged by creating or editing a widget that contains malicious JavaScript. Once the page is viewed by other users, the injected script runs with the visitor\u2019s browsing context, which can lead to session hijacking, defacement, or phishing. Hence the risk is moderately high for vulnerable installations that expose contributor\u2011level accounts to untrusted parties."}}}}, "created": "2025-12-14T21:14:29.450122+00:00", "updated": "2026-04-21T01:00:12.925120+00:00", "vendors": ["kingaddons", "kingaddons$PRODUCT$king_addons_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}