CVE-2025-12379: Phlox WordPress Plugin XSS Vulnerability

CVE-2025-12379 Overview

The Shortcodes and extra features for Phlox theme plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 2.17.13. The vulnerability exists due to insufficient input sanitization and output escaping in the tag and title_tag parameters within the Elementor heading-modern widget. This security flaw allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts into WordPress pages, which execute whenever any user accesses the compromised page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of victim users' browsers, potentially leading to session hijacking, credential theft, defacement, or further attacks against site visitors.

Affected Products

• Shortcodes and extra features for Phlox theme (auxin-elements) version 2.17.13 and earlier
• WordPress installations using the Phlox theme with the affected plugin
• Sites utilizing the Elementor page builder with the vulnerable heading-modern widget

Discovery Timeline

• 2026-01-10 - CVE CVE-2025-12379 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-12379

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability resides in the heading-modern.php file within the Elementor widgets component of the auxin-elements plugin. The vulnerable code fails to properly sanitize and escape user-supplied input in the tag and title_tag parameters before rendering them in the page output. When a user with at least Contributor-level privileges crafts malicious input containing JavaScript code in these parameters, the script is stored in the WordPress database and executed whenever the affected page is viewed by any user.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The attack requires network access and low privileges (Contributor role), but no user interaction is needed for the malicious script to execute once injected. The vulnerability has a changed scope, meaning the vulnerable component and impacted component are different—in this case, the plugin accepts the malicious input, but the victim's browser is where the script executes.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output escaping in the heading-modern Elementor widget. The tag and title_tag parameters accept user-controlled values that are rendered directly in the HTML output without proper encoding or validation. Specifically, the code at line 1194 of heading-modern.php in version 2.17.12 fails to apply WordPress escaping functions such as esc_attr() or esc_html() to these parameters before including them in the generated markup.

Attack Vector

The attack vector is network-based and requires the attacker to have at least Contributor-level authentication on the target WordPress site. An attacker with appropriate privileges can:

1. Navigate to the WordPress editor with Elementor enabled
2. Add or edit a Modern Heading widget block
3. Insert malicious JavaScript payload in the tag or title_tag parameter fields
4. Save the page, storing the malicious script in the database
5. When any user (including administrators) views the affected page, the injected script executes in their browser context

The stored nature of this XSS makes it particularly dangerous as it persists across page loads and affects all visitors to the compromised page. The malicious script could be used to steal session cookies, redirect users to phishing sites, or perform actions on behalf of authenticated users.

Detection Methods for CVE-2025-12379

Indicators of Compromise

• Unexpected or suspicious JavaScript code in page source containing the heading-modern widget output
• Unusual HTML tags or event handlers appearing in heading elements created with the Phlox theme
• Database entries in wp_posts or wp_postmeta containing encoded or obfuscated script tags in Modern Heading widget data
• User reports of unexpected browser behavior or redirects when viewing specific pages

Detection Strategies

• Review Elementor widget configurations for suspicious content in tag and title_tag parameters
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Monitor for unusual JavaScript execution patterns in browser developer tools
• Audit user accounts with Contributor or higher roles for suspicious activity

Monitoring Recommendations

• Enable WordPress audit logging to track changes to posts and pages by contributor-level users
• Set up alerts for modifications to pages containing the Modern Heading Elementor widget
• Monitor web application firewall (WAF) logs for XSS attack patterns
• Review access logs for suspicious patterns of page editing activity

How to Mitigate CVE-2025-12379

Immediate Actions Required

• Update the Shortcodes and extra features for Phlox theme plugin to a version newer than 2.17.13
• Audit existing pages using the Modern Heading widget for any injected malicious scripts
• Review and restrict Contributor-level user access until the patch is applied
• Implement a Web Application Firewall (WAF) rule to filter XSS payloads in widget parameters

Patch Information

A security patch has been released to address this vulnerability. The fix involves proper input sanitization and output escaping for the tag and title_tag parameters in the heading-modern widget. The WordPress Plugin Changeset details the specific code changes applied to remediate this issue. Site administrators should update to the patched version immediately through the WordPress plugin update mechanism.

Additional technical details can be found in the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable the auxin-elements plugin until the update can be applied
• Restrict page editing capabilities by demoting Contributor accounts to Subscriber role
• Implement strict Content Security Policy headers to prevent inline script execution
• Use a WordPress security plugin with XSS protection capabilities to filter malicious input

# Add Content Security Policy headers to wp-config.php or .htaccess
# Example for Apache .htaccess:
Header set Content-Security-Policy "script-src 'self'; object-src 'none';"