CVE-2025-64361 Overview
CVE-2025-64361 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the StylemixThemes Consulting Elementor Widgets plugin for WordPress. The flaw affects all plugin versions up to and including 1.4.2. It stems from improper neutralization of input during web page generation, tracked under [CWE-79]. An authenticated attacker with low privileges can inject malicious script content that executes in the browser context of a victim who interacts with a crafted page.
Critical Impact
Attackers with low-privileged access can execute arbitrary JavaScript in visitors' browsers, enabling session theft, credential harvesting, and unauthorized actions performed under the victim's identity.
Affected Products
- StylemixThemes Consulting Elementor Widgets plugin for WordPress
- All versions from n/a through 1.4.2
- WordPress sites running Elementor with this widget pack installed
Discovery Timeline
- 2025-10-31 - CVE-2025-64361 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64361
Vulnerability Analysis
The vulnerability exists in the Consulting Elementor Widgets plugin, which extends Elementor with widgets aimed at consulting-themed WordPress sites. The plugin renders attacker-controllable data into the DOM without adequate sanitization or output encoding. Because the injection point is processed client-side, the payload executes when the browser parses the widget-generated markup.
Exploitation requires an authenticated user with contributor-level or comparable privileges plus interaction from a second user, typically an administrator or site visitor. The scope change reflected in the vulnerability metrics indicates the injected script can affect resources beyond the vulnerable component, including the broader WordPress admin session.
Root Cause
The root cause is missing input neutralization in widget rendering logic. User-supplied values passed through widget attributes reach the DOM as executable script content rather than inert text. The plugin does not apply WordPress escaping helpers such as esc_attr(), esc_html(), or wp_kses_post() on the affected parameters before output.
Attack Vector
An attacker with a low-privileged WordPress account crafts a page or post containing the vulnerable widget with a malicious payload in a controllable field. When an administrator previews, edits, or publishes the content, the payload executes in the admin browser. Refer to the Patchstack XSS Vulnerability Report for advisory details.
No public proof-of-concept exploit code has been released. The EPSS probability is 0.154%, indicating low near-term exploitation likelihood.
Detection Methods for CVE-2025-64361
Indicators of Compromise
- Unexpected <script> tags, event handlers such as onerror= or onload=, or javascript: URIs stored in Elementor widget metadata
- New or modified WordPress administrator accounts created shortly after contributor activity
- Outbound requests from admin browsers to unfamiliar domains loaded via Elementor-rendered pages
- Elementor page revisions authored by low-privileged users containing encoded payloads such as <script>
Detection Strategies
- Audit the wp_postmeta table for Elementor data (_elementor_data) referencing suspicious HTML in Consulting widget entries
- Enable WordPress activity logging to correlate contributor edits with subsequent administrator sessions
- Deploy a web application firewall rule set that inspects Elementor AJAX payloads for XSS patterns
Monitoring Recommendations
- Monitor authenticated user role changes and privilege escalations following content edits
- Alert on Content Security Policy (CSP) violation reports originating from /wp-admin/ pages
- Track plugin file integrity for consulting-elementor-widgets to detect unauthorized modification
How to Mitigate CVE-2025-64361
Immediate Actions Required
- Update the Consulting Elementor Widgets plugin to a version released after 1.4.2 once available from StylemixThemes
- Restrict contributor and author roles from editing pages that use Consulting Elementor Widgets until patched
- Review recent Elementor-authored content from non-administrator accounts for injected script content
- Rotate administrator session cookies and credentials if suspicious widget content is found
Patch Information
At the time of NVD publication, no fixed version was listed. Site administrators should consult the Patchstack advisory and the vendor changelog for a patched release above 1.4.2.
Workarounds
- Deactivate and remove the Consulting Elementor Widgets plugin until an updated version is installed
- Enforce a strict Content Security Policy that blocks inline scripts on /wp-admin/ and public pages
- Apply virtual patching through a WordPress-aware WAF to filter script payloads in Elementor requests
- Limit content creation to trusted administrator and editor roles as an interim control
# Example Content Security Policy header for WordPress admin
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
