Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.14.
Published: 2025-04-17
Score: 7.1 High
EPSS: 1.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of input during page generation in WPDeveloper Essential Addons for Elementor allows attackers to inject malicious scripts that execute in the victim’s browser. Based on the description, it is inferred that the flaw can be triggered by crafted requests to the plugin’s input fields, leading to arbitrary JavaScript execution. This is a classic reflected XSS flaw associated with CWE‑79.

Affected Systems

WordPress sites that have installed WPDeveloper Essential Addons for Elementor Lite version 6.0.14 or earlier. The affected product is the Lite version of the plugin, identified by the vendor WPDeveloper and the product name Essential Addons for Elementor.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate to high severity level, while the EPSS score of 1% indicates a low likelihood of exploitation in the near future. The vulnerability is not listed in the CISA KEV catalog. It is inferred that the flaw can be triggered by crafted requests that inject malicious scripts into the plugin’s output, allowing an attacker to execute code in the victim's browser.

Generated by OpenCVE AI on June 18, 2026 at 02:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Essential Addons for Elementor to the latest available version, which contains the required input sanitization fix.
  • If an upgrade is not immediately possible, fully disable or delete the plugin to stop the vulnerable code from being served to users.
  • Apply input validation and output escaping to any custom forms or fields that continue to use the plugin’s code until a patch can be applied.
  • Consider using a web application firewall or security plugin to block or filter malicious requests that attempt to exploit the reflected XSS vector.

Generated by OpenCVE AI on June 18, 2026 at 02:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-11615 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Reflected XSS. This issue affects Essential Addons for Elementor: from n/a through 6.0.14.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Reflected XSS. This issue affects Essential Addons for Elementor: from n/a through 6.0.14. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Reflected XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.14.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Mon, 26 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:*

Thu, 17 Apr 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 17 Apr 2025 16:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Reflected XSS. This issue affects Essential Addons for Elementor: from n/a through 6.0.14.
Title WordPress Essential Addons for Elementor plugin <= 6.0.14 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
Wpdeveloper Essential Addons For Elementor
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:33.944Z

Reserved: 2025-01-23T14:53:00.532Z

Link: CVE-2025-24752

cve-icon Vulnrichment

Updated: 2025-04-17T17:43:51.571Z

cve-icon NVD

Status : Modified

Published: 2025-04-17T16:15:34.257

Modified: 2026-06-17T08:59:32.990

Link: CVE-2025-24752

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T02:45:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')