Critical advisory: Ultra Addons Lite for Elementor (<= 1.1.9) — Authenticated (Contributor+) Stored XSS via Animated Text Field (CVE-2025-9077)

Author: Hong Kong Security Expert
Date: 03 October 2025

Overview

A stored Cross‑Site Scripting (XSS) vulnerability has been disclosed in Ultra Addons Lite for Elementor (versions ≤ 1.1.9). An authenticated user with Contributor privileges (or higher) can inject HTML/JavaScript into an “animated text” field which is subsequently rendered on public pages without adequate output escaping. This issue is tracked as CVE-2025-9077.

The publicly reported severity is medium/low; however, practical risk varies by site configuration, number of privileged content creators, and whether high‑privilege users (editors, admins) view the affected pages. Stored XSS is persistent and can lead to serious outcomes if an admin or editor triggers the payload when viewing or previewing content.

This advisory provides technical background, detection steps, mitigations, suggested virtual‑patch approaches (generic), incident response guidance, and developer remediation advice. The tone is pragmatic and focused on actions appropriate for operators and administrators in Hong Kong and the wider APAC region.

What was disclosed (short)

• Affected software: Ultra Addons Lite for Elementor — versions ≤ 1.1.9
• Vulnerability type: Stored Cross‑Site Scripting (XSS)
• CVE: CVE‑2025‑9077
• Privilege required: Contributor (or higher)
• Impact: Persistent injection of JavaScript executing in visitors’ browsers; potential session theft, redirects, forged requests, and administrative takeover if high‑privilege users view affected pages
• Fix status at disclosure: No official vendor patch available (at time of disclosure)
• Recommended immediate action: Apply mitigations below, restrict user privileges, remove/disable the vulnerable plugin if feasible, or enable virtual patching via a WAF or equivalent controls

Technical analysis — how this stored XSS works

The vulnerability resides in an “animated text” field supplied by the plugin. Typical flow for stored XSS of this class:

1. A Contributor (or higher) edits or creates content including an Ultra Addons “animated text” widget. Widget settings may be stored as widget data, post meta, or in Elementor data structures.
2. The plugin accepts input for the animated text field without sufficient sanitization and outputs it directly into page markup.
3. Malicious JavaScript or event handlers saved in that field persist in the database. When a page containing that widget is viewed, the browser executes the injected script in the site’s origin.
4. If an admin/editor visits or previews the affected page, the script can perform privileged actions on behalf of that user (exfiltrate tokens, modify settings, create accounts, etc.).

Why Contributor privilege is relevant

Although WordPress Contributors typically lack the unfiltered_html capability and cannot publish directly, plugin logic or widget storage may bypass typical sanitization checks or assume trusted input. If widget settings are rendered without escaping, any role able to save widget settings or content that includes widgets becomes an attack vector.

Attack scenarios and potential impact

• Visitor impact (low‑privilege targets): Redirects to malicious pages, unwanted ads, phishing overlays, or attempts to exploit browser flaws.
• Admin/Editor compromise (high impact): If a privileged user opens an affected page, the payload may exfiltrate cookies or API tokens, perform authenticated requests to create/remove accounts, or install persistence mechanisms — potentially leading to full site compromise.
• SEO and reputation: Malicious content or redirects can cause search engine penalties and blacklisting.
• Propagation: Feeds or embeds could distribute the payload to other sites.

Detection methods — search for stored payloads

Inspect where Ultra Addons and Elementor store data (post content, postmeta, Elementor JSON, options) and search for script tags, event handlers, and encoded payloads.

1. Search common tables for script tags:

   SELECT ID, post_title, post_type, post_status
   FROM wp_posts
   WHERE post_content LIKE '%

2. Inspect postmeta (widget and Elementor data):

   SELECT post_id, meta_key, meta_value
   FROM wp_postmeta
   WHERE meta_value LIKE '%

3. Use WP‑CLI if available to search/export faster:

   # Search for "

4. Look for suspicious attributes: onmouseover=, onerror=, onclick=, javascript:, data: URIs, or percent‑encoded payloads (%3Cscript%3E).
5. Inspect Elementor storage keys (e.g., _elementor_data) and search JSON blobs for unexpected HTML/script content.
6. Review recent contributor edits and accounts that may have created or modified affected widgets.
7. Check server access logs for suspicious POSTs to admin endpoints (admin-ajax.php, /wp-admin/admin-post.php) and Elementor REST endpoints containing risky content.