CVE-2025-69092: 
WordPress vulnerability analysis and mitigation

CVE-2025-69092 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WPDeveloper Essential Addons for Elementor WordPress plugin. It affects the lite version of the plugin through version 6.5.3 (fixed in 6.5.4), and was published on December 30, 2025, with Patchstack credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. This type of XSS occurs when client-side JavaScript dynamically writes attacker-controlled data to the DOM without proper sanitization or encoding, allowing malicious scripts to execute in the victim's browser context. Exploitation requires the attacker to have low-level authenticated access (Contributor-level or similar) and user interaction (e.g., a victim visiting or previewing a crafted page), with the scope changed to affect other users' sessions (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user's browser session, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. Because the scope is marked as Changed, the impact can extend beyond the authenticated attacker's own session to affect other users, including administrators. Confidentiality, integrity, and availability are each assessed as Low impact (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-69092 as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term (Feedly).

WPDeveloper released version 6.5.4 of Essential Addons for Elementor (lite) to address this vulnerability. Site administrators should update the plugin to version 6.5.4 or later immediately via the WordPress admin dashboard or the WordPress plugin repository. No configuration-based workaround is known; upgrading is the only recommended remediation (Feedly, Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for January 5–11, 2026, and Sucuri referenced it in their January 2026 vulnerability patch roundup, indicating routine coverage within the WordPress security community (Wordfence, Sucuri). No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator listings.