CVE-2025-13977
Stored XSS in Essential Addons for Elementor Widgets
Publication date: 2025-12-17
Last updated on: 2025-12-17
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| essential_addons | essential_addons_for_elementor_lite | 6.5.4 |
| essential_addons | essential_addons_for_elementor_lite | 6.5.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-13977 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin, affecting versions up to and including 6.5.3. It arises from insufficient input sanitization and output escaping in two areas: the Event Calendar widget's custom attributes handling and the Image Masking module's element ID rendering. Authenticated users with Contributor-level access or higher can inject malicious scripts into pages, which execute when other users view those pages. [1, 2]
How can this vulnerability impact me? :
This vulnerability allows attackers with Contributor-level access or above to inject arbitrary malicious scripts into the website's pages. When other users visit these pages, the injected scripts execute in their browsers, potentially leading to session hijacking, defacement, data theft, or other malicious actions. This compromises the security and integrity of the affected WordPress site and its users.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability on your system, you can check the version of the Essential Addons for Elementor Lite plugin installed on your WordPress site. Versions up to and including 6.5.3 are vulnerable. You can also inspect pages using the Event Calendar widget or Image Masking features for suspicious or unexpected script injections, especially if users with Contributor-level access have made changes. Specific commands to check the plugin version via WP-CLI include: `wp plugin get essential-addons-for-elementor-lite --field=version`. Additionally, reviewing the JavaScript file `event-calendar.min.js` for unpatched versions or checking for unsanitized dynamic attributes in the Image Masking module can help identify vulnerable instances. Network detection of exploit attempts may involve monitoring HTTP requests for injected scripts targeting pages with the Event Calendar or Image Masking features. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Essential Addons for Elementor Lite plugin to version 6.5.4 or later, where the vulnerability has been addressed by properly sanitizing and escaping dynamic values in both the Event Calendar widget and the Image Masking module. Until the update is applied, restrict Contributor-level user permissions to prevent unauthorized script injections. Additionally, review and sanitize any user-generated content related to event data or image masking settings. Applying web application firewall (WAF) rules to block common XSS payloads targeting these plugin features can also help reduce risk. [2]