CVE-2025-4783

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the Countdown Timer Widget in all versions up to, and including, 2.7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-47849.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection CVE-2025-478498.8A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in t CVE-2025-47859.8A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unkn CVE-2025-478505.3In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning CVE-2025-478515.4In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible CVE-2025-478525.4In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible CVE-2025-478535.4In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible CVE-2025-478546.1In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page CVE-2025-478559.8An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3 CVE-2025-478567.2Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoi CVE-2025-478576.7A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI CVE-2025-47868.8A vulnerability was found in SourceCodester/oretnom23 Stock Management System 1.0. It has been rated as critical. This issue affects some un