CVE-2025-0371 Overview
CVE-2025-0371 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the JetElements plugin for WordPress developed by Crocoblock. The flaw exists in several widgets and stems from insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. The injected scripts execute in the browser of any user who visits the affected page. All plugin versions up to and including 2.7.2.1 are affected. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Contributor-level attackers can persist malicious JavaScript in WordPress pages, enabling session theft, account takeover, and drive-by attacks against site visitors and administrators.
Affected Products
- Crocoblock JetElements plugin for WordPress, versions ≤ 2.7.2.1
- WordPress sites using vulnerable widgets shipped with JetElements
- Multisite WordPress deployments with contributor accounts running affected versions
Discovery Timeline
- 2025-01-21 - CVE-2025-0371 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0371
Vulnerability Analysis
The JetElements plugin extends the Elementor page builder with additional widgets for building WordPress pages. Several of these widgets accept user-supplied attributes that are rendered back into page output without adequate sanitization or escaping. An authenticated user with contributor privileges can craft widget attribute values containing HTML and JavaScript payloads. When the affected page is later rendered, the browser executes the attacker-controlled script in the context of the site origin.
Because the payload is stored, exploitation does not require additional interaction to trigger. Any visitor, including administrators reviewing pending content, becomes a target. The scope change indicated by the vulnerability metrics reflects that scripts execute in the security context of end-user browsers, extending impact beyond the vulnerable plugin.
Root Cause
The root cause is missing input validation on widget attributes combined with missing output escaping when those attributes are echoed into the HTML response. WordPress provides sanitization helpers such as sanitize_text_field(), wp_kses_post(), and escaping helpers such as esc_attr() and esc_html(). The affected widgets did not consistently apply these controls before emitting attribute values into the DOM.
Attack Vector
An authenticated user with contributor-level access edits a page or post that uses a vulnerable JetElements widget. The attacker sets an attribute value to a payload such as an event handler carrying JavaScript. After the content is saved and published, or previewed by another user, the payload is rendered and executed in the victim's browser. Successful exploitation can hijack sessions, escalate privileges by targeting administrator accounts, redirect users, or deliver malware. See the Wordfence Vulnerability Overview for additional analysis.
Detection Methods for CVE-2025-0371
Indicators of Compromise
- New or modified posts and pages containing unexpected <script> tags, inline event handlers such as onerror or onload, or javascript: URIs within widget attributes
- Unexpected outbound requests from visitor browsers to attacker-controlled domains following page load
- Contributor accounts editing content outside their normal patterns or creating draft pages with embedded HTML payloads
Detection Strategies
- Query the wp_posts table for JetElements widget shortcodes or serialized Elementor data containing <script, onerror=, onload=, or javascript: substrings
- Review WordPress audit logs for content edits by contributor-level users who introduce widget-based markup
- Compare installed plugin version against 2.7.2.1 to identify hosts still exposed
Monitoring Recommendations
- Enable a web application firewall with rules that inspect POST bodies to admin-ajax.php and Elementor save endpoints for XSS payloads
- Log and alert on Content Security Policy violation reports originating from pages built with JetElements widgets
- Monitor administrator session activity for anomalous actions immediately following visits to contributor-authored pages
How to Mitigate CVE-2025-0371
Immediate Actions Required
- Update the JetElements plugin to a version later than 2.7.2.1 as published in the Crocoblock Changelog
- Audit contributor, author, and editor accounts and remove any that are unused or unrecognized
- Review recently created or edited pages that use JetElements widgets for injected script content and remove malicious payloads
Patch Information
Crocoblock addressed the vulnerability in a release subsequent to 2.7.2.1. Site administrators should consult the Crocoblock Changelog for the fixed version and apply the update through the WordPress plugin manager. Confirm the installed version after update by reviewing the Plugins page in wp-admin.
Workarounds
- Temporarily restrict contributor-level and higher account creation until the patched version is deployed
- Deploy a Content Security Policy that disallows inline scripts to limit execution of injected payloads
- Disable the JetElements plugin on sites that cannot immediately upgrade if the affected widgets are not business-critical
# Example: enumerate WordPress sites running vulnerable JetElements versions using WP-CLI
wp plugin get jet-elements --field=version
wp plugin update jet-elements
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
