PT-2025-17711 · WordPress · Xelion Webchat

Kenneth Dunn

·

Published

2025-04-24

·

Updated

2025-04-29

·

CVE-2025-3058

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Xelion Webchat plugin for WordPress versions up to and including 9.1.0
Description The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc save settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Recommendations For Xelion Webchat plugin for WordPress versions up to and including 9.1.0, update to a version higher than 9.1.0 to fix the vulnerability. As a temporary workaround, consider disabling the xwc save settings() function until a patch is available. Restrict access to the Xelion Webchat plugin to minimize the risk of exploitation.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-3058

Affected Products

Xelion Webchat