CVE-2025-68574

Executive Summary

CVE-2025-68574 is a DOM-Based Cross-Site Scripting (XSS) vulnerability found in the WordPress plugin "WPBakery Visual Composer WHMCS Elements" (void-visual-whmcs-element) by vendor Voidcoders. The vulnerability affects versions from n/a through 1.0.4.3. It stems from improper neutralization of user input during web page generation, allowing an attacker to inject malicious scripts that execute in the victim's browser within the context of the vulnerable WordPress site. The CVSS score is 5.9 (Medium), and as of this report, no official patch is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed the plugin from these sources are affected. No package manager (NPM, PyPI, Go, Ruby) is involved, but the plugin's update mechanism is the primary vector for patch distribution. Since no patch exists, users must consider manual mitigation or removal.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): Low (L) – Limited impact on service availability.

Threat Level: Medium. While the CVSS score is 5.9, the lack of a patch and the potential for DOM-based attacks in a WordPress context elevate the risk for targeted campaigns.

Deep Dive & Mechanics

The vulnerability is a DOM-Based XSS, meaning the attack payload is executed entirely on the client side without being sent to the server. The plugin likely processes user-controlled input (e.g., via URL fragments, document.referrer, or window.name) and injects it into the DOM without proper sanitization. For example, a malicious link like:

https://victim-site.com/?whmcs_element=#<script>alert('XSS')</script>

could cause the plugin to read the fragment identifier and insert it into the page, executing the script. The plugin's JavaScript code may use innerHTML, document.write, or similar unsafe methods to render data.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern. The plugin likely contains code similar to:

// Vulnerable code (hypothetical)
var userInput = window.location.hash.substring(1);
document.getElementById('whmcs-output').innerHTML = userInput;

A patched version would use safe DOM manipulation:

// Patched code (hypothetical)
var userInput = window.location.hash.substring(1);
var safeElement = document.createTextNode(userInput);
document.getElementById('whmcs-output').appendChild(safeElement);

Exploitation & Lab Setup

Red Team

1. Setup: Install WordPress with the vulnerable plugin (version <= 1.0.4.3) on a local server (e.g., XAMPP or Docker).
2. Craft Payload: Create a URL with a malicious fragment:

   http://localhost/wordpress/?page_id=1#<img src=x onerror=alert(document.cookie)>
   

3. Deliver: Send the link to a victim (simulated via browser).
4. Execute: The victim clicks the link, and the script executes, stealing cookies or performing other actions.

Blue Team

1. Detection: Monitor for unusual URL fragments containing <script>, <img onerror>, or other HTML event handlers.
2. Prevention: Implement Content Security Policy (CSP) headers to block inline scripts.
3. Mitigation: Disable or remove the plugin until a patch is available.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing #<script or #<img in the URL fragment.
• Host: Presence of the plugin directory /wp-content/plugins/void-visual-whmcs-element/.
• Logs: Web server logs showing requests with suspicious fragment identifiers.
• File: Plugin JavaScript files (e.g., void-visual-whmcs-element.js) containing unsafe DOM manipulation methods.

Detection Engineering

YARA Rule

rule CVE_2025_68574_DOM_XSS {
    meta:
        description = "Detects vulnerable WPBakery Visual Composer WHMCS Elements plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-68574"
    strings:
        $unsafe1 = /\.innerHTML\s*=/ nocase
        $unsafe2 = /document\.write\s*\(/ nocase
        $unsafe3 = /\.outerHTML\s*=/ nocase
        $hash_ref = /location\.hash/ nocase
    condition:
        all of ($unsafe*) and $hash_ref
}

Sigma Rule

title: CVE-2025-68574 DOM-Based XSS in WPBakery WHMCS Elements
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1a3d4f5e6c
status: experimental
description: Detects potential exploitation attempts of CVE-2025-68574 via URL fragments
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '#<script'
            - '#<img'
            - '#<svg'
            - '#<iframe'
            - '#onerror='
            - '#onload='
    condition: selection
falsepositives:
    - Legitimate use of hash fragments with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68574 DOM-Based XSS Attempt"; flow:to_server,established; content:"#<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-68574 DOM-Based XSS via img onerror"; content:"#<img"; http_uri; nocase; content:"onerror"; http_uri; nocase; distance:0; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or remove the void-visual-whmcs-element plugin from all WordPress installations.
2. Short-term: Monitor the vendor's website for a patched version (>= 1.0.4.4). Apply immediately when available.
3. Long-term: Implement a Web Application Firewall (WAF) rule to block malicious URL fragments containing <script, <img, or event handlers.
4. Preventive: Enforce Content Security Policy (CSP) headers with script-src 'self' to prevent inline script execution.
5. User Education: Train users not to click suspicious links, especially those with unusual URL fragments.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert