CVE-2025-9077: Ultra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in version 1.1.9 and below due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9077?
CVE-2025-9077 has a medium severity rating due to its potential for user compromise through stored cross-site scripting.
How do I fix CVE-2025-9077?
To fix CVE-2025-9077, update the Ultra Addons Lite for Elementor plugin to version 1.2.0 or later.
What versions of the Ultra Addons Lite for Elementor plugin are affected by CVE-2025-9077?
CVE-2025-9077 affects Ultra Addons Lite for Elementor plugin versions 1.1.9 and below.
Who is impacted by CVE-2025-9077?
Authenticated users of Ultra Addons Lite for Elementor plugin versions 1.1.9 and below are impacted by CVE-2025-9077.
What type of vulnerability is CVE-2025-9077?
CVE-2025-9077 is a Stored Cross-Site Scripting vulnerability.