CVE-2025-2228: Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure
The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.8 the 'registeruser' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including usernames and passwords of any users who register via the Edit Login | Registration Form widget, as long as that user opens the email notification for successful registration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2228?
CVE-2025-2228 has a severity rating that indicates a significant risk due to sensitive information exposure in the Responsive Addons for Elementor.
Who is affected by CVE-2025-2228?
CVE-2025-2228 affects all versions of the Responsive Addons for Elementor plugin up to and including version 1.6.8.
How do I fix CVE-2025-2228?
To fix CVE-2025-2228, update the Responsive Addons for Elementor plugin to the latest version released after 1.6.8.
What vulnerability does CVE-2025-2228 exploit?
CVE-2025-2228 exploits the 'register_user' function leading to sensitive information exposure for authenticated attackers.
Is CVE-2025-2228 restricted to a specific WordPress setup?
CVE-2025-2228 is not restricted and can affect any WordPress site using the vulnerable version of the Responsive Addons for Elementor.