Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
essential-addons-for-elementor-xss-poc — Hi, I am Chirag Artani. This is the POC of Reflected XSS in Essential Addons for Elementor Affecting 2+ Million Sites - CVE-2025-24752 | Kitploit
Tools/GitHubGitHub/sachinart/essential-addons-for-elementor-xss-poc
Vulnerability ScannersExploitationWeb Application ExploitationWeb SecurityPenetration TestingLearning & Education
GitHubsachinart/essential-addons-for-elementor-xss-poc

essential-addons-for-elementor-xss-poc

Hi, I am Chirag Artani. This is the POC of Reflected XSS in Essential Addons for Elementor Affecting 2+ Million Sites - CVE-2025-24752

View Repository
6411 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🔍 Essential Addons for Elementor XSS Vulnerability Detector

🚨 Critical Information

This tool is for security research and patching purposes only. Do not use it to harm sites. If you find vulnerable sites, report them responsibly to site owners so they can update immediately.

⚠️ Vulnerability Details

A reflected XSS vulnerability in Essential Addons for Elementor affects over 100K+ websites using versions below 6.0.15. This has been assigned CVE-2025-24752.

👉 Manual POC

root@kitploit:~
https://target.com/?popup-selector=<img_src=x_onerror=alert("chirag")>&eael-lostpassword=1

🖼️ Screenshots

XSS Proof of Concept Alert Demonstration

🔧 Requirements

root@kitploit:~
pip install selenium webdriver-manager

⚙️ Usage

root@kitploit:~
python poc.py targets.txt

✅ Features

  • 100% Accurate Detection: Unlike nuclei or httpx tools, this script confirms XSS by actually loading the vulnerable page in a browser and witnessing the alert execution
  • Bulk Scanning: Can process multiple targets (note: will be slower due to browser-based confirmation)
  • Perfect Detection: Nuclei template included for plugin detection in assets

📝 Detection YAML

A perfect detection template for the plugin in assets is included: detect-elementor-for-xss.yaml

📚 Additional Information & References

The vulnerability occurs due to insufficient validation and sanitizing of the popup-selector query argument, allowing a malicious value to be reflected back at the user. Fixed in version 6.0.15.

For more details: Patchstack Article

⚠️ Disclaimer

This tool is provided for educational and protective purposes only. Always obtain proper authorization before testing any website for vulnerabilities. The author is not responsible for misuse of this tool.

🙏 Acknowledgements

Thanks to responsible security researchers who identified and reported this vulnerability.

Download Tool