Stored Cross-Site Scripting in Elementor Events Addon for WordPress

CVE-2025-8150

What is CVE-2025-8150?

The Events Addon for Elementor plugin for WordPress contains a vulnerability that allows authenticated attackers, with contributor-level access and above, to exploit insufficient input sanitization and output escaping present in the Typewriter and Countdown widgets. This vulnerability may enable the injection of arbitrary web scripts, which are executed when users access compromised pages, potentially leading to unauthorized actions and data exposure.

References