CVE-2025-54704: 
WordPress vulnerability analysis and mitigation

The Easy Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-54704) discovered on July 30, 2025. This vulnerability affects versions up to and including 2.2.6 of the plugin developed by HashThemes (Rapid7, Patchstack).

The vulnerability is classified as a DOM-Based Cross-Site Scripting issue with a CVSS v3.1 Base Score of 6.5 (Medium). The attack vector is network-based, with low attack complexity, requiring low privileges and user interaction. The vulnerability has a changed scope with low impact on confidentiality, integrity, and availability (AttackerKB).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the injected page, potentially leading to unauthorized actions, data theft, or site manipulation (Rapid7).

The vulnerability has been patched in version 2.2.7 of the Easy Elementor Addons plugin. Users are advised to update to version 2.2.7 or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).