CVE-2025-12828

Name of the Vulnerable Software and Affected Versions Ultra Addons Lite for Elementor versions prior to 1.3.3

Description Stored Cross-Site Scripting occurs via the Type Out widget due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Recommendations Update Ultra Addons Lite for Elementor to version 1.3.3 or later.