Security Alert Summary
The Essential Addons for Elementor Popular Elementor Templates & Widgets plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level access or higher to inject JavaScript into pages. The issue is caused by insufficient input sanitization and output escaping in specific widget and module code paths, which can result in script execution when an injected page is viewed.
CVE Details
- CVE ID:
CVE-2025-13977 - Affected plugin / component: Essential Addons for Elementor Popular Elementor Templates & Widgets (as described in the CVE)
- Affected versions: All versions up to, and including, 6.5.3
- Published: December 17, 2025 at 4:15 AM
- Last modified: December 17, 2025 at 4:15 AM
- CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Attack requires authenticated user with low privileges (Contributor-level or higher). User interaction is None according to the CVSS data.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue caused by insufficient input sanitization and inadequate output escaping in two areas of the plugin. Specifically, the Event Calendar widget’s handling of custom attributes and the Image Masking module’s rendering of element IDs can include untrusted input in page output without proper escaping. An authenticated user with Contributor-level access or higher can supply crafted input that becomes persistently stored and later rendered on pages. When another user (or the same user viewing the page) accesses the injected page, the browser executes the injected script.
The CVE description identifies the Event Calendar widget’s custom attributes handling and the Image Masking module’s element ID rendering as the flawed code paths. The underlying cause is missing or insufficient sanitization and escaping in those rendering routines, which allows HTML or script content to be stored and later emitted into page HTML.
Impact is limited to what stored XSS can achieve from the context of rendered pages: execution of arbitrary script in the context of a victim’s browser, which can lead to theft of tokens or cookies accessible to that page, UI manipulation, or other actions available to script in that origin. The CVE data does not claim remote unauthenticated exploitation or host-level compromise.
How This Could Impact Your Website
Consider a typical site workflow: a site owner manages the site and assigns roles; internal staff create content; and external contractors or contributors add or edit pieces of content or widgets. If a contributor (or another user with similar privileges) inserts crafted input into the Event Calendar widget or the Image Masking element ID, that input can be stored and later executed in the browser of any user who views the affected page, including editors or administrators who preview content.
Practical consequences include exposure of information available in the page context (such as user-visible data), the increased risk of targeted phishing or social engineering against staff whose browsers view the injected page, and potential theft of session information accessible to page scripts. The CVSS impacts indicate limited confidentiality and integrity impact, and no direct availability impact; this reflects that the issue enables script execution in-page rather than immediate server takeover.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the CVE lists affected versions through 6.5.3).
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other non-trusted accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and extensions.
- Monitor site activity and logs for unusual behavior, particularly content edits and new widget configurations.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.1/assets/front-end/js/view/event-calendar.min.js
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.1/includes/Extensions/Image_Masking.php#L498
- https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.5.1/includes/Extensions/Image_Masking.php#L587
- https://plugins.trac.wordpress.org/changeset/3419289/essential-addons-for-elementor-lite/trunk/includes/Extensions/Image_Masking.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a0de0b28-fbad-4fcf-a7ab-35c545c19a4a?source=cve
