CVE-2025-58017
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Ultimate Store Kit Elementor Addons plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.8.6.
Risk Assessment
An attacker can inject malicious scripts that are stored and executed in a user's browser when they visit the affected page, potentially leading to session theft or account takeover.
Recommendation
Update the Ultimate Store Kit Elementor Addons plugin to a version newer than 2.8.6 that includes the fix for this vulnerability.
Other vulnerabilities in Ultimate Store Kit Elementor Addons
See all- CVE-2026-65505Medium
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.
- CVE-2026-65503Medium
The Ultimate Store Kit Elementor Addons plugin versions 3.0.5 and earlier have a Cross-Site Scripting (XSS) vulnerability exploitable by a contributor. A user with contributor role can inject malicious script.
- CVE-2026-25403Medium
The Ultimate Store Kit Elementor Addons plugin up to version 3.0.5 contains a Broken Access Control vulnerability that allows unauthenticated attackers to access functions without authorization.
- CVE-2025-69336Medium
The Ultimate Store Kit Elementor Addons plugin (up to version 2.9.4) contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized users to access functions that should be protected.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.8.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS