CVE-2025-12828

Overview

Ultra Addons Lite for Elementor plugin is vulnerable to stored XSS via the Type Out widget in all versions up to 1.3.2, allowing authenticated contributors to inject malicious scripts into pages. This flaw can lead to defacement, session hijacking, or data theft when users view affected pages. The issue is present in all WordPress installations using the affected plugin.

Description

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Impact

Confidentiality: attackers can steal user data or credentials. Integrity: malicious scripts can modify page content. Availability: repeated script execution may degrade site performance. The primary impact is on site owners and visitors who load compromised pages.

Remediation

Update Ultra Addons Lite to the latest version (≥1.3.3) or uninstall the plugin. If an update is not possible, disable the Type Out widget or remove it from all pages. Additionally, enforce a Content Security Policy that blocks inline scripts and restrict contributor roles to limit write access.

Risk context

The CVE has a medium severity (CVSS 6.4) and no EPSS data is available. While not critical, the vulnerability can be exploited by users with contributor-level access, making it a moderate risk for sites with many contributors.

Affected products

• WordPress Ultra Addons Lite for Elementor 1.3.2