CVE-2025-58220: 
WordPress vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was identified in Techeshta Card Elements for WPBakery plugin, tracked as CVE-2025-58220. The vulnerability was discovered on July 30, 2025, and publicly disclosed on September 22, 2025. This security issue affects versions through 1.0.8 of the Card Elements for WPBakery plugin and allows for DOM-Based XSS attacks (Patchstack, NVD).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It received a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires contributor-level privileges or higher to exploit (Patchstack).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects versions up to and including 1.0.8 of the Card Elements for WPBakery plugin (Patchstack).