CVE-2025-8195: fallo de gravedad media en jetmonsters JetWidgets For Elementor
JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.4epss 0.2%
The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison and Subscribe widgets in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
jetmonsters · JetWidgets For ElementorCVEs relacionadas — jetmonsters JetWidgets For Elementor
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-2138MEDIUMJetWidgets For Elementor <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box WidgetEPSS 0.4%CVE-2023-0086MEDIUMJetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings UpdateEPSS 0.4%CVE-2024-2507MEDIUMJetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URLEPSS 0.3%CVE-2024-10323MEDIUMJetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%CVE-2024-4626MEDIUMJetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id ParametersEPSS 0.3%CVE-2026-11380MEDIUMJetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' SettingEPSS 0.3%
Referencias
https://plugins.trac.wordpress.org/browser/jetwidgets-for-elementor/tags/1.0.20/includes/addons/jet-widgets-image-comparison.phphttps://plugins.trac.wordpress.org/browser/jetwidgets-for-elementor/tags/1.0.20/includes/addons/jet-widgets-subscribe-form.phphttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3364453%40jetwidgets-for-elementor&new=3364453%40jetwidgets-for-elementor&sfp_email=&sfph_mail=https://wordpress.org/plugins/jetwidgets-for-elementor/#developershttps://www.wordfence.com/threat-intel/vulnerabilities/id/9d8a03f7-a028-401c-9088-77e75dd365f6?source=cve