CVE-2025-0321

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-0321", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-01-07T23:58:53.076Z", "datePublished": "2025-01-28T07:21:40.701Z", "dateUpdated": "2026-04-08T16:41:13.771Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:13.771Z"}, "affected": [{"vendor": "wpmet", "product": "ElementsKit Pro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.7.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the \u2018url\u2019 parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "ElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/204cfe20-9df1-4f6c-a38c-a21b43dde385?source=cve"}, {"url": "https://wpmet.com/plugin/elementskit/"}, {"url": "https://wpmet.com/plugin/elementskit/roadmaps/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-01-27T19:08:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-28T14:53:17.280735Z", "id": "CVE-2025-0321", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-28T15:14:27.859Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0321", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-28T14:53:17.280735Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-28T14:46:34.390Z"}}], "cna": {"title": "ElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpmet", "product": "ElementsKit Pro", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.7.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-01-27T19:08:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/204cfe20-9df1-4f6c-a38c-a21b43dde385?source=cve"}, {"url": "https://wpmet.com/plugin/elementskit/"}, {"url": "https://wpmet.com/plugin/elementskit/roadmaps/"}], "descriptions": [{"lang": "en", "value": "The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the \u2018url\u2019 parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-01-28T07:21:40.701Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0321", "state": "PUBLISHED", "dateUpdated": "2025-01-28T15:14:27.859Z", "dateReserved": "2025-01-07T23:58:53.076Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-01-28T07:21:40.701Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ElementsKit Pro", "vendor": "wpmet", "versions": [{"lessThanOrEqual": "3.7.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpmet:elementskit:*:*:*:*:pro:wordpress:*:*", "matchCriteriaId": "5D57D782-4088-4776-88EF-9F00BE21591C", "versionEndExcluding": "3.7.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the \u2018url\u2019 parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento ElementsKit Pro para WordPress es vulnerable a Cross-Site Scripting Almacenado basado en DOM a trav\u00e9s del par\u00e1metro \u2018url\u2019 en todas las versiones hasta la incluida 3.7.8 debido a un escape de entrada desinfecci\u00f3n y salida insuficiente. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitraria en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-0321", "lastModified": "2026-06-17T08:26:16.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0321", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-28T14:53:17.280735Z", "version": "2.0.3"}}]}, "published": "2025-01-28T08:15:29.810", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wpmet.com/plugin/elementskit/"}, {"source": "security@wordfence.com", "tags": ["Issue Tracking"], "url": "https://wpmet.com/plugin/elementskit/roadmaps/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/204cfe20-9df1-4f6c-a38c-a21b43dde385?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T03:45:25.672902+00:00", "value": {"mitigation_remediation": ["Update ElementsKit Pro to a version newer than 3.7.8.", "If an update cannot be applied, deactivate or delete the plugin from the site.", "Review and restrict WordPress user roles, removing Contributor or higher access from users who do not require it to reduce the attack surface."], "summary": {"action": "Apply Patch", "impact": "Stored XSS allowing arbitrary script execution"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the ElementsKit Pro plugin from wpmet installed, including all releases up to version 3.7.8.", "description_and_impact": "The ElementsKit Pro plugin is affected by a DOM\u2011Based Stored Cross\u2011Site Scripting flaw that originates from the unchecked \u2018url\u2019 parameter in all versions up to 3.7.8. The vulnerability follows CWE\u201179, enabling an attacker who can authenticate with Contributor or higher level access to inject arbitrary web scripts. Those scripts are stored within the plugin\u2019s pages and run automatically whenever any user visits the affected page, potentially compromising confidentiality, integrity, and availability of the site and its visitors.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The attack is limited to authenticated users with Contributor or higher privileges, but once a script is injected it is executed for any subsequent user who views the page. The vulnerability is not listed in the CISA KEV catalog, so there is no current evidence of active exploitation in the wild."}}}}, "created": "2026-04-28T04:00:05.417993+00:00", "updated": "2026-04-28T04:00:05.418017+00:00", "vendors": []}