Executive Summary

CVE-2025-13977 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin, affecting versions up to and including 6.5.3. It arises from insufficient input sanitization and output escaping in two areas: the Event Calendar widget's custom attributes handling and the Image Masking module's element ID rendering. Authenticated users with Contributor-level access or higher can inject malicious scripts into pages, which execute when other users view those pages. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with Contributor-level access or above to inject arbitrary malicious scripts into the website's pages. When other users visit these pages, the injected scripts execute in their browsers, potentially leading to session hijacking, defacement, data theft, or other malicious actions. This compromises the security and integrity of the affected WordPress site and its users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your system, you can check the version of the Essential Addons for Elementor Lite plugin installed on your WordPress site. Versions up to and including 6.5.3 are vulnerable. You can also inspect pages using the Event Calendar widget or Image Masking features for suspicious or unexpected script injections, especially if users with Contributor-level access have made changes. Specific commands to check the plugin version via WP-CLI include: `wp plugin get essential-addons-for-elementor-lite --field=version`. Additionally, reviewing the JavaScript file `event-calendar.min.js` for unpatched versions or checking for unsanitized dynamic attributes in the Image Masking module can help identify vulnerable instances. Network detection of exploit attempts may involve monitoring HTTP requests for injected scripts targeting pages with the Event Calendar or Image Masking features. [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Essential Addons for Elementor Lite plugin to version 6.5.4 or later, where the vulnerability has been addressed by properly sanitizing and escaping dynamic values in both the Event Calendar widget and the Image Masking module. Until the update is applied, restrict Contributor-level user permissions to prevent unauthorized script injections. Additionally, review and sanitize any user-generated content related to event data or image masking settings. Applying web application firewall (WAF) rules to block common XSS payloads targeting these plugin features can also help reduce risk. [2]

Useful 0 Not Useful 0