Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3.
Published: 2025-12-24
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a DOM‑based XSS caused by failure to neutralize input during page generation, allowing arbitrary script execution in the user’s browser. It falls under CWE‑79.

Affected Systems

Affected installations are those running the voidcoders WPBakery Visual Composer WHMCS Elements plugin version 1.0.4.3 or older. The issue applies from the plugin’s initial release through 1.0.4.3.

Risk and Exploitability

The CVSS score of 5.9 indicates a moderate risk. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a DOM‑based cross‑site scripting attack that occurs when user input is processed during web page generation and subsequently executed by the browser.

Generated by OpenCVE AI on April 29, 2026 at 22:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WPBakery Visual Composer WHMCS Elements plugin to a version later than 1.0.4.3 if a newer release is available.
  • Apply proper output encoding and input validation to all data handled by the plugin, using WordPress functions such as esc_html() and esc_attr().
  • If an upgrade is not immediately possible, restrict access to the plugin’s settings to trusted administrators or temporarily deactivate the plugin from the WordPress administrative interface.

Generated by OpenCVE AI on April 29, 2026 at 22:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Mon, 29 Dec 2025 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Voidcoders
Voidcoders wpbakery Visual Composer Whmcs Elements
Wordpress
Wordpress wordpress
Vendors & Products Voidcoders
Voidcoders wpbakery Visual Composer Whmcs Elements
Wordpress
Wordpress wordpress

Wed, 24 Dec 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 24 Dec 2025 13:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements: from n/a through <= 1.0.4.3.
Title WordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Voidcoders Wpbakery Visual Composer Whmcs Elements
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:30.666Z

Reserved: 2025-12-19T10:17:34.321Z

Link: CVE-2025-68574

cve-icon Vulnrichment

Updated: 2025-12-24T18:51:25.913Z

cve-icon NVD

Status : Deferred

Published: 2025-12-24T13:16:24.423

Modified: 2026-04-27T19:16:32.107

Link: CVE-2025-68574

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T22:15:16Z

Weaknesses