CVE-2025-9045

MediumCVSS 6.4

Published: 03/10/2025(UTC)Updated: 12/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions up to and including 2.2.9 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page.

Risk Assessment

The risk involves potential session hijacking, data theft, or malware distribution within the context of a trusted WordPress page.

Recommendation

Immediately update the Easy Elementor Addons plugin to the latest patched version and restrict user privileges to the minimum necessary.

Other vulnerabilities in Easy Elementor Addons

CVE-2026-28164Critical
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons. Allows an attacker to perform unauthorized actions on behalf of a logged-in user. Affects versions up to 2.3.7.

Original NVD description (English source)

The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS