Stored Cross-Site Scripting Vulnerability in MarqueeAddons Plugin for WordPress
CVE-2025-8199
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 December 2025
What is CVE-2025-8199?
The MarqueeAddons plugin for WordPress exhibits a vulnerability that allows for Stored Cross-Site Scripting through its Testimonial Marquee widget. This flaw arises from inadequate input sanitization and output escaping on user-supplied attributes, enabling authenticated users with contributor-level access or higher to insert arbitrary scripts into pages. Consequently, these scripts execute when any user views an affected page, potentially compromising user data and website integrity.
Affected Version(s)
Marquee Addons for Elementor – Advanced Elements & Modern Motion Widgets * <= 2.4.3