CVE-2025-9082

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9082", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-15T15:54:21.466Z", "datePublished": "2026-01-28T06:43:43.643Z", "dateUpdated": "2026-04-08T17:10:57.048Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:57.048Z"}, "affected": [{"vendor": "wpbits", "product": "WPBITS Addons For Elementor Page Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget parameters in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping when dynamic content is enabled. This makes it possible for authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99b47856-502e-4e9d-b0ea-62c57509b46a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/image_compare.php#L607"}, {"url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/tooltip.php#L860"}, {"url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/text_rotator.php#L369"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442812%40wpbits-addons-for-elementor&new=3442812%40wpbits-addons-for-elementor&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-09-02T21:23:53.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-27T17:39:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T14:57:06.090417Z", "id": "CVE-2025-9082", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T14:57:16.255Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T14:57:06.090417Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T14:57:10.754Z"}}], "cna": {"title": "WPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpbits", "product": "WPBITS Addons For Elementor Page Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-02T21:23:53.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-27T17:39:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99b47856-502e-4e9d-b0ea-62c57509b46a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/image_compare.php#L607"}, {"url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/tooltip.php#L860"}, {"url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/text_rotator.php#L369"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442812%40wpbits-addons-for-elementor&new=3442812%40wpbits-addons-for-elementor&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget parameters in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping when dynamic content is enabled. This makes it possible for authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:57.048Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9082", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:10:57.048Z", "dateReserved": "2025-08-15T15:54:21.466Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-28T06:43:43.643Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPBITS Addons For Elementor Page Builder", "vendor": "wpbits", "versions": [{"lessThanOrEqual": "1.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget parameters in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping when dynamic content is enabled. This makes it possible for authenticated attackers with contributor-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin WPBITS Addons para Elementor para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de m\u00faltiples par\u00e1metros de widget en versiones hasta la 1.8, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes cuando el contenido din\u00e1mico est\u00e1 habilitado. Esto hace posible que atacantes autenticados con permisos de nivel de colaborador y superiores inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-9082", "lastModified": "2026-06-17T10:08:16.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9082", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-28T14:57:06.090417Z", "version": "2.0.3"}}]}, "published": "2026-01-28T07:15:59.920", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/image_compare.php#L607"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/text_rotator.php#L369"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/widgets/tooltip.php#L860"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442812%40wpbits-addons-for-elementor&new=3442812%40wpbits-addons-for-elementor&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99b47856-502e-4e9d-b0ea-62c57509b46a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:08:48.981213+00:00", "value": {"mitigation_remediation": ["Update WPBITS Addons For Elementor to the latest released version that fixes the XSS issue.", "If an update cannot be deployed immediately, disable or remove dynamic content in the image_compare, text_rotator, and tooltip widgets, or delete instances that contain user-supplied content.", "Re\u2011evaluate contributor-level permissions on the WordPress site and restrict or remove such accounts until the vulnerability is resolved."], "summary": {"action": "Patch ASAP", "impact": "Stored Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "The affected product is the WPBITS Addons For Elementor Page Builder plugin for WordPress. Versions up to and including 1.8 are impacted. WordPress sites that have any of the vulnerable image_compare, text_rotator, or tooltip widgets enabled can be compromised by malicious content submitted through these widgets.", "description_and_impact": "The WPBITS Addons For Elementor plugin contains a stored XSS vulnerability, classified as CWE-79. Insufficient sanitization of widget parameters allows authenticated users with contributor-level access to inject malicious scripts that run whenever someone visits a page containing the widget. An attacker can execute arbitrary JavaScript, potentially stealing session cookies, defacing the page, or launching further attacks.", "risk_and_exploitability": "The CVSS score of 6.4 categorizes the flaw as moderate. The EPSS score is below 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, so no widely used exploits are known. Attack vectors require a legitimate contributor-level or higher account to the WordPress administrative interface; once authenticated, the attacker can insert payloads into the vulnerable widget parameters that are stored and rendered to all visitors. The impact is primarily integrity and confidentiality of users within the site, with potential for defacement and session hijacking."}}}}, "created": "2026-01-29T09:18:27.610725+00:00", "updated": "2026-04-21T16:15:40.502080+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpbits", "wpbits$PRODUCT$wpbits_addons_for_elementor_page_builder"]}