CVE-2025-58220
BaseFortify
Publication date: 2025-09-22
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| techeshta | card_elements_for_wpbakery | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58220 is a Cross-Site Scripting (XSS) vulnerability in the WordPress Card Elements for WPBakery plugin versions up to 1.0.8. It allows attackers with contributor-level privileges to inject malicious scripts into web pages generated by the plugin. These scripts can execute when visitors access the affected website, potentially causing redirects, displaying unwanted advertisements, or executing other harmful HTML payloads. This vulnerability is DOM-based and classified under OWASP Top 10 category A3: Injection. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts on your website, which can compromise user experience and security. Potential impacts include unwanted redirects, injection of advertisements, or other harmful actions performed through the injected scripts. Although the severity is considered low (CVSS 6.5) and exploitation is unlikely, automated attacks may still occur. If exploited, it could lead to compromised website integrity and trustworthiness. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for malicious script injections in the affected WordPress Card Elements for WPBakery Plugin (versions up to 1.0.8). Since the vulnerability allows DOM-based XSS, you can look for unusual or unexpected JavaScript code in the plugin's output or web pages. Server-side malware scanning or professional incident response is recommended as plugin-based malware scanners may be unreliable. Specific commands are not provided, but using web vulnerability scanners that detect XSS or inspecting HTTP responses for injected scripts can help. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying Patchstack's virtual patching (vPatching) technology, which auto-mitigates the vulnerability without an official patch. Since no official fix is available, enabling this virtual patching provides rapid protection without impacting performance. Additionally, restrict contributor-level privileges to trusted users to reduce exploitation risk and monitor for suspicious activity. If compromise is suspected, seek professional incident response. [1]