PT-2025-8685 · Elementor · Essential Addons For Elementor

Xssium · Published 2025-02-26 · Updated 2026-01-26 · CVE-2025-24752

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor (affected versions not specified)

Description A critical XSS flaw has been identified in the Essential Addons for Elementor WordPress plugin, potentially placing over two million websites in jeopardy. This vulnerability can allow attackers to inject malicious scripts and execute XSS attacks. The issue is related to the src/js/view/general.js file. It is estimated that over 2 million WordPress sites are affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-24752

Affected Products

Essential Addons For Elementor

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2025-24752 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24752 · Vendor Advisory
• https://twitter.com/hotCyberspace/status/1894925287512776787 · Twitter Post
• https://twitter.com/Netlas_io/status/1894680652185821188 · Twitter Post
• https://twitter.com/cybercronai/status/1913453873580159401 · Twitter Post
• https://twitter.com/syedaquib77/status/1894611390717149603 · Twitter Post
• https://twitter.com/VULNERAsecurity/status/1894815270021054619 · Twitter Post
• https://twitter.com/adriananglin/status/1894649385759150124 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-0-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/NoSpy_ch/status/1894922603791356313 · Twitter Post
• https://twitter.com/fridaysecurity/status/1894571277102284985 · Twitter Post
• https://t.me/cveNotify/149869 · Telegram Post
• https://twitter.com/zoomeye_team/status/1894643655778213906 · Twitter Post
• https://t.me/pentestingnews/57089 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1894569621078118770 · Twitter Post