CVE-2025-62887

Executive Summary

CVE-2025-62887 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the King Addons for Elementor WordPress plugin (by KingAddons.com). The flaw exists in versions <= 51.1.61 and allows an attacker to inject malicious scripts into the DOM of a victim’s browser without proper server-side sanitization. Since this is a WordPress plugin, the attack surface is limited to sites running the vulnerable plugin, but the impact can be severe for end users (session hijacking, credential theft, defacement). No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem. Users should treat this as a supply chain risk: if the plugin is installed, the site is vulnerable. No patched version has been released, so the only mitigation is to disable or remove the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link or visit a malicious page)
• Scope: Changed (XSS can affect other resources)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium – Exploitation requires user interaction, but the attack surface is broad (any site using the plugin). No public exploit exists, but the vulnerability is trivial to exploit once discovered.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS in the King Addons for Elementor plugin. The plugin processes user-supplied input (likely via URL fragments, document.referrer, or window.name) and injects it into the DOM without proper sanitization. Because the input is never sent to the server, traditional server-side filters are bypassed.

Root Cause: The plugin uses JavaScript to read data from the location.hash, location.search, or other DOM sources and writes it directly into innerHTML or similar sinks. For example, a widget might display a user-provided parameter in a tooltip or modal without escaping.

Attack Flow:

1. Attacker crafts a malicious URL: https://victim-site.com/?king_addon_param=<img src=x onerror=alert(1)>
2. Victim clicks the link.
3. The plugin’s JavaScript reads the parameter and injects it into the DOM.
4. The injected script executes in the victim’s browser context.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern. The vulnerable code likely resembles:

// Vulnerable pattern (DOM-based XSS)
var param = new URLSearchParams(window.location.search).get('king_addon_param');
document.getElementById('output').innerHTML = param;

A patched version would use safe DOM manipulation:

// Patched pattern
var param = new URLSearchParams(window.location.search).get('king_addon_param');
document.getElementById('output').textContent = param; // or use DOMPurify

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit exists, we provide a basic PoC. This is for authorized testing only.

PoC HTML (hosted on attacker-controlled server):

<!DOCTYPE html>
<html>
<body>
<script>
// Craft a malicious URL that triggers the XSS
var payload = '<img src=x onerror=alert("XSS")>';
var url = 'https://victim-site.com/?king_addon_param=' + encodeURIComponent(payload);
window.open(url);
</script>
</body>
</html>

Manual Exploitation:

1. Identify a page using the King Addons plugin (e.g., a page with a custom widget).
2. Append a parameter like ?king_addon_param=<script>alert(1)</script> to the URL.
3. If the parameter is reflected in the DOM without sanitization, the script executes.

Blue Team (Detection & Hardening)

Detection:

• Monitor web logs for requests containing suspicious parameters (e.g., <script>, <img onerror=, javascript:).
• Use browser-based CSP headers to block inline scripts.

Hardening:

• Disable or remove the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block common XSS payloads in query strings.
• Add Content Security Policy (CSP) header: default-src 'self'; script-src 'self'.

Indicators of Compromise (IOCs)

• URL Patterns: ?king_addon_param=* or #king_addon_param=* containing script tags.
• DOM Artifacts: Unexpected <script> or <img> elements injected into the page.
• Network Traffic: Outbound requests to attacker-controlled domains (if the payload exfiltrates data).
• File Hashes: No specific file hashes available; the vulnerable plugin version is king-addons <= 51.1.61.

Detection Engineering

YARA Rule

rule CVE_2025_62887_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS in King Addons for Elementor plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62887"
    strings:
        $vuln_func = /\.innerHTML\s*=\s*.*(?:location|document\.URL|location\.hash|location\.search)/ nocase
        $param_name = "king_addon_param"
    condition:
        $vuln_func and $param_name
}

Sigma Rule

title: CVE-2025-62887 - King Addons DOM XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of DOM-based XSS in King Addons for Elementor
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "king_addon_param=<"
            - "king_addon_param=%3C"
            - "king_addon_param=javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62887 - King Addons DOM XSS Attempt"; flow:to_server; content:"king_addon_param"; http_uri; pcre:"/king_addon_param=[^&]*<[^>]*script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or uninstall the King Addons for Elementor plugin until a patched version is released.
2. Workaround: If the plugin is critical, implement a WAF rule to block requests containing king_addon_param with suspicious characters.
3. Long-term: Monitor the vendor’s website (kingaddons.com) for updates. Consider switching to an alternative Elementor addon plugin.
4. User Education: Advise users not to click on suspicious links, especially those containing query parameters.

Valters IT – Securing the digital frontier.