CVE-2025-67947: 
WordPress vulnerability analysis and mitigation

CVE-2025-67947 is a Reflected Cross-Site Scripting (XSS) vulnerability in the AdForest Elementor WordPress plugin developed by scriptsbundle. It affects all versions of the plugin up to and including 3.0.11, and was reported by researcher João Pedro S Alcântara (Kinorth) on November 5, 2025, with public disclosure on January 20–22, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), assigned by CISA-ADP (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS flaw. It arises from insufficient sanitization or escaping of user-supplied input that is reflected back in the plugin's web page output, allowing an attacker to inject malicious JavaScript. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must click a crafted malicious link or visit a specially crafted page for the payload to execute (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim user's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim (including administrative actions if an admin is targeted), and injection of malicious redirects or advertisements into the site. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the user's browser environment (Patchstack).

No active in-the-wild exploitation has been confirmed at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a low current probability of exploitation. However, Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the AdForest Elementor plugin version 3.0.11 or earlier using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint that includes a reflected XSS payload in a query parameter (e.g., https://target-site.com/?vulnerable_param=<script>malicious_code</script>).
3. Deliver the payload: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social engineering, or embedding it in a forum post or comment.
4. Victim interaction: When the victim clicks the link and their browser loads the page, the unsanitized input is reflected in the HTML response and the injected script executes in their browser session.
5. Achieve objective: The executed script can steal session cookies, capture credentials, perform actions on the WordPress admin panel on behalf of the victim, or redirect the user to a malicious site (Patchstack).

• Network: HTTP GET or POST requests to WordPress pages with URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=) in query parameters associated with the AdForest Elementor plugin.
• Logs: Web server access logs showing requests with XSS payloads in query strings directed at plugin-related endpoints; unusual referrer headers in access logs indicating crafted link delivery.
• File System: Unexpected modifications to plugin files in wp-content/plugins/adforest-elementor/ that could indicate post-exploitation tampering.
• Process/Behavior: Unusual outbound connections from victim browsers to attacker-controlled domains following interaction with a crafted link; new admin accounts created or plugin/theme changes made without authorization.

The vulnerability is patched in AdForest Elementor version 3.0.12. Site administrators should update the plugin to version 3.0.12 or later immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for Patchstack users to block exploitation attempts until the plugin is updated. If unable to update, consider temporarily deactivating the plugin and consulting your hosting provider or web developer (Patchstack).

Wordfence included CVE-2025-67947 in its weekly WordPress vulnerability report covering January 19–25, 2026, highlighting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence). The vulnerability was discovered and reported by independent researcher João Pedro S Alcântara (Kinorth) through Patchstack's coordinated disclosure process (Patchstack).