Stored Cross-Site Scripting Issue in Enter Addons Plugin for WordPress
CVE-2025-8687
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 December 2025
What is CVE-2025-8687?
The Enter Addons plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through its Countdown and Image Comparison widgets. This issue arises due to inadequate input sanitization and improper output escaping of user-supplied attributes. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute whenever a user visits the compromised page, potentially leading to unauthorized access or data theft.
Affected Version(s)
Enter Addons – Ultimate Template Builder for Elementor * <= 2.2.7