CVE-2025-1261: 
WordPress vulnerability analysis and mitigation

The HT Mega – Absolute Addons For Elementor plugin for WordPress contains a DOM-Based Stored Cross-Site Scripting vulnerability (CVE-2025-1261) discovered in March 2025. The vulnerability affects all versions up to and including 2.8.2 and is particularly notable as it stems from an incomplete fix for a previous vulnerability (CVE-2024-3307). This security issue exists in the plugin's Countdown widget due to insufficient input sanitization and output escaping on user-supplied attributes (NVD Database).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The technical classification falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-site Scripting. The vulnerability specifically manifests in the plugin's Countdown widget component, where insufficient input sanitization and output escaping of user-supplied attributes creates the security weakness (NVD Database).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially compromising user data and website security (NVD Database).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low (AC:L), requiring network access (AV:N) and low privileges (PR:L), with no user interaction (UI:N) needed for exploitation (NVD Database).

A fix has been released in version 2.8.3 of the HT Mega – Absolute Addons For Elementor plugin. Users are advised to update to this latest version to mitigate the vulnerability (WordPress Plugin).