Cross-Site Scripting in WPDeveloper Essential Addons for Elementor
CVE-2025-24752

7.1HIGH

Key Information:

Vendor

WPdeveloper

Status
Essential Addons For Elementor
Vendor
CVE Published:
17 April 2025

Badges

📰 News Worthy

What is CVE-2025-24752?

A cross-site scripting vulnerability exists in WPDeveloper Essential Addons for Elementor, allowing attackers to inject malicious scripts into web pages viewed by users. If exploited, this vulnerability enables reflected XSS attacks, where harmful scripts are executed in users' browsers, potentially leading to data theft, session hijacking, or unauthorized actions. The issue affects versions of the Essential Addons for Elementor up to 6.0.14, emphasizing the need for users to secure their installations and update to the latest version to mitigate risks.

Affected Version(s)

Essential Addons for Elementor 0 <= 6.0.14

News Articles

favicon imageCybersecurityNews

WordPress Plugin Vulnerability Exposes Millions of Websites to Script Injection Attacks

A critical security vulnerability in the Essential Addons for Elementor plugin (CVE-2025-24752) has put over two million WordPress websites at risk of cross-site scripting (XSS) attacks. 

References

https://patchstack.com/database/Wordpress/Plugin/essentia...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 📰

    First article discovered by CybersecurityNews

  • Vulnerability Reserved

Credit

xssium (Patchstack Alliance)
.