CVE-2025-9082

CVE-2025-9082 describes a Stored Cross-Site Scripting (XSS) vulnerability in the WPBITS Addons For Elementor plugin for WordPress, affecting versions up to and including 1.8. This flaw allows authenticated attackers with contributor-level permissions or higher to inject malicious web scripts into pages when dynamic content is enabled, which then execute when a user views the compromised page. The vulnerability has a CVSS score of 6.4 (Medium), indicating it can be exploited remotely with low complexity and requires low privileges, potentially leading to limited impact on confidentiality and integrity. While the FAUCET Risk Score is high at 86/100, its EPSS score is very low, suggesting a minimal probability of exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also absent, indicating a lack of widespread attention or exploitation attempts at this time.