CVE-2025-58220: WPBakery Card Elements DOM-Based XSS Flaw

CVE-2025-58220 Overview

CVE-2025-58220 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the Techeshta Card Elements for WPBakery WordPress plugin. The flaw affects all plugin versions from initial release through version 1.0.8. The vulnerability stems from improper neutralization of input during web page generation, classified under [CWE-79]. Attackers with low privileges can inject malicious scripts that execute in the browser context of victims who interact with crafted content. Successful exploitation can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated users. The vulnerability was published to the National Vulnerability Database (NVD) on September 22, 2025.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft and administrative account compromise when a WordPress administrator is targeted.

Affected Products

Techeshta Card Elements for WPBakery WordPress plugin, versions up to and including 1.0.8
WordPress installations using the card-elements-for-wpbakery plugin
Sites running WPBakery Page Builder with the affected card elements extension

Discovery Timeline

2025-09-22 - CVE-2025-58220 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58220

Vulnerability Analysis

The vulnerability is a DOM-based XSS flaw in the Card Elements for WPBakery plugin. DOM-based XSS occurs when client-side JavaScript writes attacker-controlled data into the Document Object Model (DOM) without proper sanitization or output encoding. Unlike reflected or stored XSS, the payload never needs to reach the server response body; the malicious script executes as the browser processes attacker-influenced DOM sources.

The plugin accepts input passed through card element attributes or shortcode parameters that are later rendered into HTML by client-side scripts. Because the plugin does not properly neutralize special characters, an attacker can inject markup that the browser interprets as executable JavaScript. Exploitation requires user interaction and low-level authentication, which typically translates to contributor or editor accounts on multi-user WordPress sites.

Root Cause

The root cause is missing or insufficient input sanitization and output encoding in the plugin's card rendering logic. User-supplied data flows into DOM sinks such as innerHTML, document.write, or jQuery html() calls without encoding characters like <, >, and quotation marks. This allows arbitrary HTML and JavaScript to be inserted into the rendered page.

Attack Vector

An attacker with low-privileged access authors content that embeds a malicious card element containing crafted attribute values. When a victim, typically an administrator reviewing content, loads the affected page, the injected JavaScript executes with the victim's browser session. Because the vulnerability has a changed scope, code executed in the victim's context can act on resources beyond the vulnerable plugin, including WordPress administrative functions. Consult the Patchstack XSS Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-58220

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror or onload, or javascript: URIs stored in WordPress post meta or shortcode attributes tied to card elements
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading pages containing card element shortcodes
New administrator accounts or modified user roles created immediately after an administrator viewed content authored by a lower-privileged user
Session cookies or nonces appearing in web server access logs as query parameters to external endpoints

Detection Strategies

Audit the wp_posts and wp_postmeta tables for shortcode parameters containing HTML entities, script tags, or encoded JavaScript payloads
Deploy web application firewall (WAF) rules that flag XSS payload patterns in POST requests to /wp-admin/post.php and REST API endpoints
Monitor browser Content Security Policy (CSP) violation reports for inline script executions on pages rendered by the plugin

Monitoring Recommendations

Enable WordPress audit logging to record content creation and modification events by contributor and editor accounts
Correlate content publication events with subsequent administrative privilege changes to identify potential exploitation chains
Review plugin version inventories across all WordPress installations and alert on any instance running Card Elements for WPBakery version 1.0.8 or earlier

How to Mitigate CVE-2025-58220

Immediate Actions Required

Identify all WordPress sites running Card Elements for WPBakery version 1.0.8 or earlier and prioritize them for remediation
Restrict contributor and editor account creation until the plugin is patched or removed
Review recently published content for suspicious shortcodes, script tags, or unusual attribute values on card elements
Force password resets and invalidate active sessions for all administrative accounts if exploitation is suspected

Patch Information

At the time of publication, no vendor-supplied fixed version is referenced in the CVE record. Site owners should monitor the Patchstack advisory for an updated release and apply patches as soon as they become available.

Workarounds

Deactivate and remove the Card Elements for WPBakery plugin until a patched version is released
Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Apply a virtual patch through a web application firewall to block XSS payloads targeting the plugin's shortcode parameters
Limit content authoring privileges to trusted users and require editorial review before publishing content that uses card element shortcodes

bash

# Disable the vulnerable plugin using WP-CLI
wp plugin deactivate card-elements-for-wpbakery
wp plugin delete card-elements-for-wpbakery

# Add a Content Security Policy header via .htaccess
# Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'"