CVE-2025-9077

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9077", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-15T15:32:57.491Z", "datePublished": "2025-10-03T11:17:12.365Z", "dateUpdated": "2026-04-08T16:52:30.224Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:30.224Z"}, "affected": [{"vendor": "ultrapressorg", "product": "Ultra Addons Lite for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and below due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Ultra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/513f116b-84d3-4848-b608-f2a2ee57a9a2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.1.9/elements/typeout.php#L276"}, {"url": "https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.2.0/elements/typeout.php#L276"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-11-12T18:33:35.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-02T22:15:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T18:10:01.211031Z", "id": "CVE-2025-9077", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:10:14.651Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9077", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T18:10:01.211031Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T18:10:09.941Z"}}], "cna": {"title": "Ultra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "ultrapressorg", "product": "Ultra Addons Lite for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-12T18:33:35.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-02T22:15:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/513f116b-84d3-4848-b608-f2a2ee57a9a2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.1.9/elements/typeout.php#L276"}, {"url": "https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.2.0/elements/typeout.php#L276"}], "descriptions": [{"lang": "en", "value": "The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and below due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:30.224Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9077", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:52:30.224Z", "dateReserved": "2025-08-15T15:32:57.491Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:12.365Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ultra Addons Lite for Elementor", "vendor": "ultrapressorg", "versions": [{"lessThanOrEqual": "1.1.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and below due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Ultra Addons Lite para Elementor para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del campo 'Animated Text' del widget Typeout en la versi\u00f3n 1.1.9 e inferiores debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de nivel de colaborador y superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-9077", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9077", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T18:10:01.211031Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:45.517", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.1.9/elements/typeout.php#L276"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ut-elementor-addons-lite/tags/1.2.0/elements/typeout.php#L276"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/513f116b-84d3-4848-b608-f2a2ee57a9a2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:37:00.953201+00:00", "value": {"mitigation_remediation": ["Upgrade Ultra Addons Lite for Elementor to version 1.2.0 or later, which removes the XSS vulnerability.", "If an upgrade is not possible, delete the Typeout Widget or set its content to a trusted value and disable editing permissions for contributors on that widget.", "As a temporary measure, restrict contributor access to the WordPress backend or disable content editing for users with less than administrator privileges until a patch is applied."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Ultrapressorg Ultra Addons Lite for Elementor is affected when running version 1.1.9 or earlier. Modern installations (version 1.2.0 and above) contain the fix. Administrators should check the exact version in the WordPress plugin list and ensure the plugin is current or removed.", "description_and_impact": "The code in the Animated Text field of the Typeout Widget in Ultra Addons Lite for Elementor versions up to 1.1.9 does not properly validate or escape user input. This deficiency allows an attacker with contributor or higher permissions to insert arbitrary JavaScript that is stored and rendered within page content. When a page containing the edited widget is viewed, the attacker\u2019s script runs in the visitor\u2019s browser, leading to theft of user data, session hijacking, defacement, or deflecting victim traffic. The weakness corresponds to CWE\u201179, a classic reflected and stored XSS scenario.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests a very low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. However, because the attack requires authenticated contributor\u2011level access, any site that allows contributors to edit content is at risk. Attackers can embed malicious scripts that execute in the browsers of all visitors to the affected page. The impact is limited to the scope of the site\u2019s content rather than system-wide compromise. The likely attack vector is through the WordPress administrative interface, where a contributor can edit the Typeout Widget and submit malicious content, which is then stored and later rendered to all users."}}}}, "created": "2025-10-06T14:42:54.939751+00:00", "updated": "2026-04-21T02:45:25.946222+00:00", "vendors": ["elementor", "elementor$PRODUCT$elementor", "ultrapressorg", "ultrapressorg$PRODUCT$ultra_addons_lite_for_elementor", "wordpress", "wordpress$PRODUCT$wordpress"]}