CVE-2025-8214

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-09-30

Last updated on: 2026-04-08

Assigner: Wordfence

Description

The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typing Letter widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-09-30

Last Modified

2026-04-08

Generated

2026-07-06

AI Q&A

2025-09-30

EPSS Evaluated

2026-07-05

NVD

CVE-2025-8214

EUVD

EUVD-2025-31678

Affected Vendors & Products

Vendor	Product	Version / Range
the_pack	elementor_addon	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the Pack Elementor addon plugin for WordPress, specifically in the Typing Letter widget. It occurs because the plugin does not properly sanitize or escape user-supplied input attributes. As a result, authenticated users with contributor-level access or higher can inject malicious scripts into pages. These scripts execute whenever any user accesses the infected page, potentially compromising site security.

Impact Analysis

The vulnerability allows attackers with contributor-level access or above to inject arbitrary web scripts into pages. This can lead to unauthorized actions such as stealing user credentials, hijacking user sessions, defacing the website, or distributing malware to visitors. Additionally, Resource 1 highlights a related severe issue where certain plugin actions can cause complete deletion of site content with no recovery option, indicating potential for significant data loss and site disruption. [1]

Mitigation Strategies

Immediate steps to mitigate this vulnerability include updating the Pack Elementor addon plugin to version 2.1.6 or later, as the plugin was closed and updated to address critical issues. Additionally, avoid using the Typing Letter widget in versions up to 2.1.5 and restrict contributor-level access or higher until the plugin is fully reviewed and patched. Consider backing up your site data regularly to prevent data loss due to potential exploitation or plugin errors. [1]

Hi! I’m here to help you understand CVE-2025-8214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70