CVE-2025-68574: 
WordPress vulnerability analysis and mitigation

CVE-2025-68574 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WPBakery Visual Composer WHMCS Elements WordPress plugin (slug: void-visual-whmcs-element) developed by voidCoders. It affects all versions from the initial release through version 1.0.4.3. The vulnerability was published on December 24, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 5.9 (Medium) (Red Hat CVE, Patchstack).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as a DOM-Based XSS variant (CAPEC-588). In DOM-Based XSS, attacker-controlled data is written to the DOM by client-side JavaScript without proper sanitization or encoding, allowing script injection that executes in the victim's browser context. Exploitation requires high privileges and user interaction, meaning an attacker with elevated access (e.g., an administrator or editor role) must craft a malicious payload that is then triggered when another authenticated user visits the affected page (Red Hat CVE, Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a victim who views the affected page, with a changed scope (the injected script runs in the context of the victim's session rather than the attacker's). This can result in low-level confidentiality impact (e.g., session token theft or credential harvesting), low integrity impact (e.g., page content manipulation), and low availability impact. Given the high privilege requirement for injection, the practical risk is somewhat limited, but a compromised high-privilege account could use this to further attack lower-privileged users or site visitors (Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-68574. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the WPBakery Visual Composer WHMCS Elements plugin (void-visual-whmcs-element) at version 1.0.4.3 or earlier, using tools like WPScan or manual inspection of plugin directories.
2. Obtain high-privilege access: Acquire administrator or editor credentials on the target WordPress site (e.g., via credential stuffing, phishing, or a separate vulnerability).
3. Inject malicious payload: Using the high-privilege account, insert a DOM-Based XSS payload into a plugin-rendered field or shortcode parameter that is processed client-side without sanitization (e.g., a WHMCS element configuration field in the WPBakery editor).
4. Deliver to victim: Publish or share the affected page/post so that a target user (e.g., another admin or a site visitor) loads it in their browser.
5. Payload execution: When the victim's browser renders the page, the injected JavaScript executes in their session context, potentially stealing cookies, redirecting the user, or performing actions on their behalf (Red Hat CVE).

• Logs: WordPress access logs showing unusual POST or GET requests to pages containing WPBakery WHMCS Elements shortcodes with encoded or obfuscated JavaScript strings (e.g., <script>, javascript:, onerror=, onload= patterns in parameter values.
• File System: Unexpected modifications to plugin files under wp-content/plugins/void-visual-whmcs-element/ that may indicate tampering with plugin source to persist payloads.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages hosting WHMCS Elements content.
• Browser/Application: Reports from users of unexpected redirects, pop-ups, or session anomalies when viewing pages that use the WPBakery WHMCS Elements plugin.

WordPress site administrators should update the WPBakery Visual Composer WHMCS Elements plugin (void-visual-whmcs-element) to a version beyond 1.0.4.3 if a patched release is available from the plugin vendor (voidCoders). If no patch is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, restricting high-privilege WordPress roles to trusted users only reduces the attack surface, as exploitation requires high privileges (Red Hat CVE, Patchstack).