CVE-2025-2225

Description

The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rael_title_tag' parameter in all versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 1.6.9.

PUBLISHED Reserved 2025-03-11 | Published 2025-04-15 | Updated 2025-04-15 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

Prissy Mesh finder

References

www.wordfence.com/...-530e-4a69-bbf7-e2c66491dd75?source=cve

plugins.trac.wordpress.org/...ons-for-elementor-icon-box.php

plugins.trac.wordpress.org/changeset/3261241/

plugins.trac.wordpress.org/changeset/3263280/

cve.org (CVE-2025-2225)

nvd.nist.gov (CVE-2025-2225)

Download JSON