CVE-2025-67951: 
WordPress vulnerability analysis and mitigation

CVE-2025-67951 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WPZOOM Addons for Elementor WordPress plugin. It affects all versions up to and including 1.2.10, with version 1.2.11 containing the fix. The vulnerability was reported by security researcher Abu Hurayra on November 6, 2025, disclosed by Patchstack on December 6, 2025, and published to NVD on December 16, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious input is processed and rendered by the browser's JavaScript engine without proper sanitization, rather than being reflected or stored server-side. Exploitation requires the attacker to have at least Contributor or Developer-level privileges on the WordPress site, and a privileged user must interact with a crafted page or link to trigger the payload. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and execute malicious JavaScript in the browsers of site visitors, potentially enabling session hijacking, credential theft, malicious redirects, or defacement of the affected WordPress site. Because the scope is changed (S:C in CVSS), the impact extends beyond the plugin itself to the broader browser context of visiting users. Confidentiality, integrity, and availability are all assessed as low impact individually, but the combined effect on site visitors and site reputation can be significant in mass-exploit scenarios (Patchstack).

No active in-the-wild exploitation has been reported, and no public exploit code is known to exist. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority and notes it is unlikely to be exploited, though XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins (Patchstack, NVD).

The vulnerability is patched in WPZOOM Addons for Elementor version 1.2.11. Site administrators should update the plugin to version 1.2.11 or later immediately via the WordPress admin dashboard. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting Contributor/Developer role access until the update can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).