CVE-2025-8874

🗓️ 12 Aug 2025 06:42:41Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 16 Views

CVE-2025-8874 Stored XSS in Master Addons Elementor; Auth Contributor+ to 2.0.8.6 fancyBox

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-8874	12 Aug 202508:09	–	circl
CNNVD	WordPress plugin Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations 跨站脚本漏洞	12 Aug 202500:00	–	cnnvd
Cvelist	CVE-2025-8874 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox	12 Aug 202506:42	–	cvelist
EUVD	EUVD-2025-24226	3 Oct 202520:07	–	euvd
NVD	CVE-2025-8874	12 Aug 202507:15	–	nvd
Patchstack	WordPress Master Addons for Elementor plugin <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox vulnerability	11 Aug 202522:11	–	patchstack
Positive Technologies	PT-2025-32634 · WordPress +1 · The Master Addons – Elementor Addons +1	12 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-8874	14 Aug 202507:28	–	redhatcve
Vulnrichment	CVE-2025-8874 Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox	12 Aug 202506:42	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (August 11, 2025 to August 17, 2025)	21 Aug 202514:13	–	wordfence

Vulners

Node

litonice13 master_addons_for_elementor_widgets,_extensions,_theme_builder,_popup_builder_&_template_kitsRange≤2.0.9.0wordpress

[
  {
    "vendor": "litonice13",
    "product": "Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.0.9.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/log/master-addons/
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/44e4fb1b-eed4-4ef9-9856-7c5095117aa7
plugins	www.plugins.trac.wordpress.org/browser/master-addons/trunk/assets/vendor/fancybox/jquery.fancybox.min.js

15 Apr 2026 00:35Current

6Medium risk

Vulners AI Score6

CVSS 3.16.4

EPSS0.0008

SSVC

CWE-79