CVE-2025-62748
Lifecycle Timeline
2Tags
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Products Web and WooCommerce Addons for WPBakery Builder vc-addons-by-bit14 allows DOM-Based XSS.This issue affects Web and WooCommerce Addons for WPBakery Builder: from n/a through <= 1.5.
Analysis
DOM-based cross-site scripting (XSS) in Genetech Products Web and WooCommerce Addons for WPBakery Builder (vc-addons-by-bit14) plugin versions up to 1.5 allows unauthenticated attackers to inject malicious scripts that execute in the context of affected user sessions. The vulnerability stems from improper neutralization of user-supplied input during web page generation. EPSS scoring (0.01%, percentile 3%) indicates very low real-world exploitation probability despite the nature of the flaw, and no public exploit code or active exploitation has been confirmed.
Technical Context
This is a DOM-based XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a WordPress plugin that extends WPBakery Page Builder with additional web and e-commerce components. DOM-based XSS occurs when client-side JavaScript directly uses unsanitized input from the DOM to modify the page, allowing attackers to craft malicious payloads that bypass server-side sanitization. The affected plugin (CPE: wordpress:plugin:vc-addons-by-bit14) is a third-party extension that integrates with WPBakery's page building framework. The vulnerability likely exists in JavaScript handlers that process user-controlled parameters without proper output encoding or content security policy enforcement.
Affected Products
Genetech Products Web and WooCommerce Addons for WPBakery Builder (WordPress plugin slug: vc-addons-by-bit14) versions through 1.5 are affected. This includes all releases from the plugin's inception through version 1.5 inclusive. The plugin is hosted in the WordPress.org plugin repository and integrates with WPBakery Page Builder (formerly Visual Composer) to provide additional page-building components for WordPress sites, including WooCommerce-specific functionality.
Remediation
Update the vc-addons-by-bit14 plugin to a version newer than 1.5 if available from the WordPress plugin repository, or disable and remove the plugin if no patched version is released. WordPress site administrators should access their WordPress dashboard (wp-admin), navigate to Plugins > Installed Plugins, locate 'Web and WooCommerce Addons for WPBakery Builder', and either update it or deactivate it pending availability of a patched release. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/vc-addons-by-bit14/vulnerability/wordpress-web-and-woocommerce-addons-for-wpbakery-builder-plugin-1-5-cross-site-scripting-xss-vulnerability) for confirmation of patch availability and any vendor guidance. As a temporary mitigation, limit plugin access to trusted users and ensure Content Security Policy headers are configured to restrict inline script execution.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today