CVE-2025-0353

Vulnerability

Details The Divi Torque Lite plugin for WordPress, up to version 4.1.0, contains a Stored Cross-Site Scripting (XSS) vulnerability in several of its widgets. This arises from insufficient input sanitization and output escaping on user-supplied attributes, allowing attackers to inject malicious scripts that are stored on the server.

Exploitation

To exploit this vulnerability, an attacker must have at least contributor-level access to the WordPress site. They can inject arbitrary web scripts through widget attributes, which are then executed when any user views the affected page. No additional authentication or network position is required beyond the initial contributor access.

Impact

Successful exploitation enables the attacker to perform actions such as session hijacking, website defacement, or redirecting users to malicious sites. The injected scripts execute in the context of the victim's browser, potentially compromising sensitive data or user sessions.

Mitigation

The vulnerability has been addressed in a version beyond 4.1.0. Users are advised to update the Divi Torque Lite plugin to the latest available version from the WordPress plugin repository [1]. No workaround is currently documented.