Stored Cross-Site Scripting Vulnerability in Ultra Addons Lite for Elementor Plugin by WordPress

CVE-2025-9077

What is CVE-2025-9077?

The Ultra Addons Lite for Elementor plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability through the 'Animated Text' field of the Typeout Widget. This flaw arises from inadequate input sanitization and output escaping, allowing authenticated attackers with contributor-level access and higher to inject malicious web scripts. Such scripts can execute when users access compromised pages, posing a significant security risk to WordPress sites utilizing this plugin.

References