CVE-2025-8146 in Qi Addons for Elementor Plugin
Summary
by MITRE • 08/02/2025
The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2025
The Qi Addons For Elementor plugin represents a popular extension for WordPress websites that enhances the functionality of the Elementor page builder with additional widgets and features. This particular vulnerability affects versions up to and including 1.9.2 of the plugin, which has been widely distributed across WordPress installations. The vulnerability specifically targets the TypeOut Text widget, a feature designed to create dynamic text effects on web pages. The security flaw stems from inadequate input sanitization and output escaping mechanisms within the plugin's codebase, creating a persistent XSS vector that can be exploited by malicious actors with relatively low privileges.
The technical nature of this vulnerability allows authenticated attackers who possess contributor-level access or higher to inject malicious scripts into the plugin's TypeOut Text widget functionality. When users navigate to pages containing the injected content, the malicious scripts execute in their browsers, potentially leading to session hijacking, data theft, or redirection to malicious websites. This stored XSS vulnerability operates by bypassing the standard input validation checks that should occur when users enter data into the widget parameters. The lack of proper output escaping means that user-supplied content is directly rendered without adequate sanitization, creating a persistent threat that affects all users who access pages containing the malicious payload.
The operational impact of this vulnerability extends beyond simple script execution, as it can be leveraged for more sophisticated attacks within the compromised WordPress environment. Attackers could potentially harvest user credentials, manipulate content, or establish persistent backdoors through the injected scripts. The vulnerability affects the integrity of the entire website since any page containing the malicious widget content becomes a potential attack vector. From an attacker's perspective, this represents a low-effort, high-impact exploit due to the relatively low privilege requirements needed to trigger the vulnerability. The stored nature of the XSS means that the malicious code persists even after the initial injection, continuously affecting users who access the compromised pages.
Security professionals should prioritize immediate remediation of this vulnerability by updating to the latest version of the Qi Addons For Elementor plugin where the XSS flaw has been addressed. Organizations should implement additional monitoring for suspicious activity within their WordPress installations, particularly around contributor-level user actions and content modifications. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and it maps to ATT&CK technique T1566.001 for the initial access phase through malicious content. Network segmentation and user access controls should be reviewed to limit the potential impact of such vulnerabilities, while regular security audits of third-party plugins can help identify similar issues before they can be exploited. The incident underscores the critical importance of maintaining up-to-date security practices and the necessity of thorough input validation and output escaping mechanisms in web application development.