CVE-2025-8488

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_hfe_compatibility_option_callback ()function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the compatibility option setting.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 2, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-84899.8The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilegCVE-2025-84904.4The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up tCVE-2025-84914.3The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.CVE-2025-84925.3The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modiCVE-2025-84939.8A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknowCVE-2025-84949.8A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affecCVE-2025-84959.8A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknowCVE-2025-84969.8A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is anCVE-2025-84979.8A weakness has been identified in code-projects Online Medicine Guide 1.0. This affects an unknown part of the file /cusfindphar2.php. This CVE-2025-84989.8A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /CVE-2025-84999.8A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown cCVE-2025-85008.8A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unkn