CVE-2025-69360: 
WordPress vulnerability analysis and mitigation

CVE-2025-69360 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the TheGem Theme Elements (for WPBakery) WordPress plugin developed by CodexThemes. It affects all versions of the plugin up to and including 5.11.0, with version 5.11.1 being the patched release. The vulnerability was reported on December 11, 2025, by researcher João Pedro S Alcântara (Kinorth), disclosed by Patchstack on January 6, 2026, and published to NVD on the same date. It carries a CVSS v3.1 base score of 6.5 (Medium), as assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests as a DOM-Based XSS flaw, meaning malicious script execution occurs client-side within the browser's DOM rather than being reflected or stored server-side. Exploitation requires an authenticated attacker with at least Contributor-level privileges to inject a malicious payload, and successful exploitation additionally requires a privileged user (e.g., an administrator) to interact with the crafted content — such as visiting a manipulated page. The specific vulnerable parameter or shortcode within the WPBakery page builder integration has not been publicly detailed beyond the Patchstack advisory (Patchstack, NVD).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious content. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress environment and its users (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-69360. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, though this specific CVE is rated low priority by Patchstack. It does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites running the TheGem Theme Elements (for WPBakery) plugin at version 5.11.0 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Content: Create or edit a post/page using the WPBakery page builder, injecting a DOM-Based XSS payload into a vulnerable TheGem element parameter (e.g., a shortcode attribute that is unsafely rendered in the DOM).
4. Deliver to Victim: Share or publish the crafted content so that a privileged user (e.g., an administrator) visits or previews the page, triggering the malicious JavaScript in their browser.
5. Achieve Objective: The executed script can steal session cookies, perform actions on behalf of the admin (e.g., create rogue admin accounts, install malicious plugins), or redirect visitors to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing unusual POST requests to page/post editing endpoints from low-privileged accounts; unexpected page edits or content changes by Contributor-level users in WordPress audit logs.
• File System: Unexpected modifications to WordPress post content containing obfuscated JavaScript or <script> tags within WPBakery shortcode attributes.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages containing TheGem WPBakery elements; unusual JavaScript-initiated requests in browser developer tool network logs.
• Process/Behavior: Admin accounts performing unexpected actions (new user creation, plugin installation) without corresponding legitimate activity, potentially indicating session hijacking via XSS (Patchstack).

The vendor has released version 5.11.1 of the TheGem Theme Elements (for WPBakery) plugin, which resolves this vulnerability. Site administrators should update the plugin to version 5.11.1 or later immediately. As a temporary workaround if updating is not immediately possible, restrict Contributor-level user registration and review existing Contributor accounts for suspicious activity. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability received standard automated coverage across vulnerability aggregation platforms (Vulners, VulnDB, CVEFeed) and a brief mention on Bluesky via the CVE tracking account. Patchstack, the assigning CNA, rated it low priority with no impactful threat assessment. No notable independent researcher commentary or significant media coverage has been identified beyond routine vulnerability database entries (Patchstack).