The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and including, 2.7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Wed, 06 Aug 2025 20:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 06 Aug 2025 08:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Devscred
Devscred exclusive Addons For Elementor Exclusiveaddons Exclusiveaddons exclusive Addons For Elementor Wordpress Wordpress wordpress |
|
Vendors & Products |
Devscred
Devscred exclusive Addons For Elementor Exclusiveaddons Exclusiveaddons exclusive Addons For Elementor Wordpress Wordpress wordpress |
Wed, 06 Aug 2025 04:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and including, 2.7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | Exclusive Addons for Elementor <= 2.7.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown | |
Weaknesses | CWE-79 | |
References |
|
|
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: Wordfence
Published: 2025-08-06T03:41:00.255Z
Updated: 2025-08-06T19:28:24.067Z
Reserved: 2025-07-11T15:06:32.836Z
Link: CVE-2025-7498

Updated: 2025-08-06T19:28:20.885Z

Status : Awaiting Analysis
Published: 2025-08-06T04:16:20.620
Modified: 2025-08-06T20:23:37.600
Link: CVE-2025-7498

No data.