CVE-2025-12828 in Ultra Addons Lite for Elementor Plugin
Summary
by MITRE • 10/03/2026
The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Type Out widget in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The Ultra Addons Lite plugin for WordPress represents a significant attack surface within the popular Elementor ecosystem, particularly when considering its widespread adoption among website developers and content creators. The vulnerability identified affects all versions up to and including 1.3.2, centering specifically on the Type Out widget functionality. This component is designed to create dynamic text animations, but it fails to implement adequate security controls for user-supplied input attributes. In a typical WordPress environment, plugins often accept various parameters from users to customize display settings, such as font size, color, or animation speed. However, in this specific instance, the plugin does not sufficiently sanitize these inputs nor escape them upon output rendering. This architectural oversight creates a direct pathway for malicious actors to inject client-side code into web pages that are subsequently served to legitimate visitors.
The technical nature of this flaw is classified as Stored Cross-Site Scripting, which corresponds directly with CWE-79 in the Common Weakness Enumeration standard. Unlike reflected XSS where the payload is part of an immediate request, stored vulnerabilities persist within the application's data store, such as a database or file system. When an attacker successfully injects malicious JavaScript via the Type Out widget attributes, this code becomes permanently embedded in the page content. Consequently, every time any user accesses that specific page, their browser executes the injected script automatically. This persistence amplifies the severity of the vulnerability because it does not require social engineering to trick a victim into clicking a specially crafted link; rather, the mere act of viewing the compromised page triggers the exploit.
The operational impact is further exacerbated by the authentication and privilege requirements necessary to trigger this flaw. The vulnerability allows exploitation by authenticated attackers who possess contributor-level access or higher within the WordPress environment. While this requirement limits the pool of potential initial attackers compared to unauthenticated vulnerabilities, it remains a critical risk for any site where multiple users have editing capabilities. Contributors often manage content creation and may be trusted with publishing articles that include rich media elements like animated text widgets. An attacker gaining such access can silently plant malicious scripts across numerous pages or posts. The execution of arbitrary web scripts in the context of the victim's browser allows for a wide range of malicious activities, including session hijacking through cookie theft, credential harvesting via keyloggers, defacement of the website content, and potentially using the compromised site as a vector to attack other users visiting the page.
From an offensive security perspective, this vulnerability aligns with several tactics in the MITRE ATT&CK framework for enterprise environments. Specifically, it falls under T1059, Command and Scripting Interpreter, as JavaScript is executed within the browser environment. Furthermore, if the script facilitates unauthorized access to user accounts or data, it relates to T1078, Valid Accounts, by leveraging existing credentials obtained through the XSS payload. The persistence of the code also touches upon T1486, Data Encrypted for Impact, if used in ransomware scenarios, though more commonly it serves reconnaissance and lateral movement purposes within a compromised network perimeter.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary and most effective solution is to upgrade the Ultra Addons Lite plugin to version 1.3.3 or later, where developers have presumably implemented proper input sanitization using functions like wp_kses_post or similar WordPress standards for escaping output with esc_html or esc_attr depending on the context. For organizations unable to update immediately due to compatibility concerns, temporary mitigations should include restricting contributor-level access to only highly trusted individuals and implementing a Web Application Firewall that can detect and block common XSS payloads in POST requests associated with widget attribute updates. Additionally, enabling Content Security Policy headers can help mitigate the impact of any successful injection by restricting the sources from which scripts are allowed to execute, thereby preventing inline script execution unless explicitly whitelisted. Regular security audits and code reviews focusing on input validation and output encoding practices are essential to prevent similar vulnerabilities in custom or third-party WordPress plugins moving forward.