CVE-2025-8200

The vulnerability is a Stored Cross-Site Scripting (XSS) in the Countdown Timer widget of the Mega Elements – Addons for Elementor plugin for WordPress. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, allowing attackers to inject arbitrary web scripts.

Exploitation requires an authenticated user with at least contributor-level access to WordPress. The attacker can embed malicious scripts in the Countdown Timer widget settings, which are stored and executed when any user views the compromised page.

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites.

The vulnerability is patched in version 1.3.3, released on 2025-09-12, as noted in the plugin's changelog [1]. Users are advised to update to the latest version immediately.