CVE-2025-8489

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-84904.4The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up t CVE-2025-84914.3The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.CVE-2025-84925.3The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modi CVE-2025-84939.8A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknow CVE-2025-84949.8A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affec CVE-2025-84959.8A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknow CVE-2025-84969.8A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is an CVE-2025-84979.8A weakness has been identified in code-projects Online Medicine Guide 1.0. This affects an unknown part of the file /cusfindphar2.php. This CVE-2025-84989.8A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /CVE-2025-84999.8A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown c CVE-2025-85008.8A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unkn CVE-2025-85015.4A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown funct