CVE-2025-9045

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9045", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-14T19:02:06.754Z", "datePublished": "2025-10-03T11:17:06.706Z", "dateUpdated": "2026-04-08T16:34:14.683Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:14.683Z"}, "affected": [{"vendor": "hashthemes", "product": "Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08640d56-fc76-4062-ab08-19415ad77e5e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L871"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L868"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L864"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/image-comparison/widgets/image-comparison.php#L376"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/image-comparison/widgets/image-comparison.php#L377"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.3.0/modules/image-comparison/widgets/image-comparison.php#L376"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.3.0/modules/countdown/widgets/countdown.php#L871"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-10-02T22:34:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T16:00:05.143922Z", "id": "CVE-2025-9045", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T16:00:21.849Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9045", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-03T16:00:05.143922Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T16:00:13.654Z"}}], "cna": {"title": "Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "hashthemes", "product": "Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:34:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08640d56-fc76-4062-ab08-19415ad77e5e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L871"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L868"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L864"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/image-comparison/widgets/image-comparison.php#L376"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/image-comparison/widgets/image-comparison.php#L377"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.3.0/modules/image-comparison/widgets/image-comparison.php#L376"}, {"url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.3.0/modules/countdown/widgets/countdown.php#L871"}], "descriptions": [{"lang": "en", "value": "The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:14.683Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9045", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:34:14.683Z", "dateReserved": "2025-08-14T19:02:06.754Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:06.706Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder", "vendor": "hashthemes", "versions": [{"lessThanOrEqual": "2.2.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Easy Elementor Addons para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de varios par\u00e1metros de widget en versiones inferiores o iguales a 2.2.8 debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-9045", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9045", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T16:00:05.143922Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:45.340", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L864"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L868"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/countdown/widgets/countdown.php#L871"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/image-comparison/widgets/image-comparison.php#L376"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.2.8/modules/image-comparison/widgets/image-comparison.php#L377"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.3.0/modules/countdown/widgets/countdown.php#L871"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/easy-elementor-addons/tags/2.3.0/modules/image-comparison/widgets/image-comparison.php#L376"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08640d56-fc76-4062-ab08-19415ad77e5e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:14:48.906961+00:00", "value": {"mitigation_remediation": ["Update the Easy Elementor Addons plugin to at least version 2.3.0, in which the XSS vectors are sanitized and escaped.", "If an update is not feasible, remove contributor and editor capabilities from users who can modify widget content or disable the affected widgets entirely.", "Configure a web application firewall or content filtering rule to block script payloads submitted through widget fields and monitor logs for suspicious activity."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability is limited to the Easy Elementor Addons \u2013 Addons Pack for Elementor Page Builder developed by hashthemes. All installations running version 2.2.9 or older are affected, regardless of the WordPress core or other plugins. No other products are impacted.", "description_and_impact": "The Easy Elementor Addons plugin for WordPress allows stored Cross\u2011Site Scripting through several widget parameters when its version is 2.2.9 or earlier. The flaw is caused by insufficient input sanitization and output escaping, enabling authenticated users with contributor or higher privileges to embed arbitrary scripts into pages. Once injected, the script runs in the browsers of any user who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The weakness is identified as CWE\u201179.", "risk_and_exploitability": "With a CVSS score of 6.4 the flaw represents moderate severity, but its EPSS score is listed as less than 1%, indicating a very low likelihood of exploitation. The flaw is not included in the CISA KEV catalog. Exploitation requires an authenticated user with contributor-level or higher access, which limits the attack surface to internally privileged users. Attackers would likely target sites with loose role enforcement or insufficient review of widget content. Despite the moderate score, the low EPSS and privileged access requirement reduce the immediate threat level for most organizations."}}}}, "created": "2025-10-06T14:42:58.107078+00:00", "updated": "2026-04-22T14:15:20.428716+00:00", "vendors": ["hashthemes", "hashthemes$PRODUCT$easy_elementor_addons", "wordpress", "wordpress$PRODUCT$wordpress"]}