Security readout for executives and security teams
Plain-English summary
A logged-in WordPress user with Contributor access or higher could plant browser-executed script in pages using affected Element Pack widgets. The script runs when someone visits the altered page, potentially exposing user data or enabling unauthorized page actions within that visitor’s session.
Executive priority
Prioritize remediation on public sites with multiple content contributors, valuable administrator sessions, or sensitive customer workflows. This is not an unauthenticated compromise, but a malicious or compromised low-privilege account can turn ordinary pages into a persistent browser attack. Address promptly through normal vulnerability-management timelines.
Technical view
CVE-2025-1457 is a DOM-based stored cross-site scripting flaw caused by insufficient sanitization and output escaping in the Wrapper Link, Countdown, and Gallery widgets. The supplied description covers versions through 5.10.28. It has CVSS 3.1 score 6.4 and requires authenticated Contributor-level access or higher.
Likely exposure
Exposure is likely where Element Pack version 5.10.28 or earlier is installed and untrusted or compromised Contributor-level accounts can edit affected widget content. Risk increases when privileged administrators or customers visit injected pages. The structured affected-version field is unclear, so confirm scope against current vendor guidance.
Exploitation context
The attacker must authenticate with Contributor privileges or greater and modify a page using an affected widget. Visiting the injected page triggers the stored script without additional victim interaction. The bundle marks this CVE as absent from KEV and supplies no evidence of active exploitation.
Researcher notes
The supplied title and description identify versions through 5.10.28, although the structured affected record lists version “0” with default status unaffected. Treat version scope as needing vendor confirmation. Referenced WordPress changesets suggest code changes, but the bundle does not explicitly name a fixed release. No active exploitation evidence is supplied.
Mitigation direction
- Inventory WordPress sites running Element Pack and record installed versions.
- Consult vendor guidance and update to a confirmed fixed release when identified.
- Restrict Contributor access and remove unnecessary or untrusted accounts until remediation.
- Review affected widget content and remove unauthorized modifications.
- Consider disabling the plugin or affected widgets if acceptable operationally.
Validation and detection
- Confirm whether each site runs Element Pack version 5.10.28 or earlier.
- Identify pages using Wrapper Link, Countdown, or Gallery widgets.
- Review recent page changes made by Contributor-level or compromised accounts.
- Inspect affected pages for unexpected script execution or unauthorized browser behavior.
- After remediation, confirm affected pages render without unauthorized scripts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-1457 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N3.12.7WordfenceVulnerability scoring details
Base CVSS 3.1 score
6.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c6ac5484-3caa-4821-990b-cd49c2c4873d?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-wrapper-link.min.jsCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/modules/ep-countdown.min.jsCVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3272946%40bdthemes-element-pack-lite&new=3272946%40bdthemes-element-pack-lite&sfp_email=&sfph_mail=#file1097CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.