CVE-2025-22758

WordPress Elementor AI Addons plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Jan 15, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through <= 2.2.1.

Analysis

AI-generated

Technical impact

Improper neutralization of user input in the Elementor AI Addons plugin permits DOM‑based XSS. An attacker can embed malicious scripts that execute in the victim’s browser, allowing arbitrary client‑side code to run.

Affected Systems

Affected systems include WordPress websites that use the Harnani Elementor AI Addons plugin version 2.2.1 or earlier. Versions newer than 2.2.1 are not vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score of <1 % shows a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is DOM‑based XSS, exploitation requires a victim to interact with malicious content processed by the plugin; the attacker can only run code in the victim’s browser and does not gain remote code execution.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Elementor AI Addons to a version newer than 2.2.1.
  • If an upgrade is not feasible, disable or remove the plugin from the site.
  • Deploy a Web Application Firewall or enforce a Content Security Policy to block XSS payloads.

Generated by OpenCVE AI on May 2, 2026 at 09:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-2972 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aiwp Elementor AI Addons allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through 2.2.1.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aiwp Elementor AI Addons allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through 2.2.1. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through <= 2.2.1.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aiwp Elementor AI Addons allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through 2.2.1.
Title WordPress Elementor AI Addons plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Jan 7, 2025, 9:04 PM

View source JSON

Updated
Jan 15, 2025, 7:06 PM

JSON

Status
Deferred
Published
Jan 15, 2025, 4:15 PM
Modified
Jun 17, 2026, 8:49 AM

View source JSON

No data.

Updated
May 2, 2026, 10:00 AM

JSON