CVE-2025-26912: WordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability
Published Feb 25, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.6.
Affected Software
1 affected component
HashThemes Easy Elementor Addons<=2.1.6
Remediation
Information
Update the WordPress Easy Elementor Addons wordpress plugin to the latest available version (at least 2.1.7).
Event History
Feb 25, 2025
CVE Published
via MITRE·02:17 PM
Data Sourced
via MITRE·02:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-26912?
CVE-2025-26912 is considered a medium-severity vulnerability due to its potential for stored cross-site scripting (XSS).
2
How do I fix CVE-2025-26912?
To fix CVE-2025-26912, update the Easy Elementor Addons plugin to version 2.1.7 or later.
3
What software is affected by CVE-2025-26912?
CVE-2025-26912 affects the Easy Elementor Addons plugin versions up to and including 2.1.6.
4
What type of vulnerability is CVE-2025-26912?
CVE-2025-26912 is classified as a Cross-site Scripting (XSS) vulnerability.
5
Can CVE-2025-26912 be exploited remotely?
Yes, CVE-2025-26912 can be exploited remotely if an attacker can inject malicious scripts that are stored and executed on the site.