CVE-2025-8779 is a stored cross-site scripting vulnerability (CWE-79) in the All-in-One Addons for Elementor – WidgetKit WordPress plugin. It affects the Team and Countdown widgets due to improper neutralization of input during web page generation, allowing authenticated contributors or higher to inject arbitrary scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability exists in all versions up to 2.5.6. There is no vendor advisory or patch information provided, and the plugin is not a cloud service.

An attacker with contributor-level or higher privileges can inject malicious JavaScript into pages via vulnerable widgets. This script executes in the browsers of users who view the compromised pages, potentially leading to theft of user credentials, session tokens, or other sensitive information. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Consider disabling or removing the affected widgets (Team and Countdown) if possible to reduce exposure. Monitor for plugin updates from the vendor addressing this vulnerability.