PT-2025-3846 · WordPress · Divi Torque Lite

Craig Smith + 1 · Published 2025-01-29 · Updated 2025-01-29 · CVE-2025-0353

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Divi Torque Lite plugin for WordPress versions up to, and including, 4.1.0

Description The issue is related to Stored Cross-Site Scripting via several widgets due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations For Divi Torque Lite plugin for WordPress versions up to, and including, 4.1.0: Update to a version later than 4.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable widgets until a patch is available. Avoid using the vulnerable widgets in pages that can be accessed by untrusted users until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-0353

Affected Products

Divi Torque Lite

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2025-0353 · Security Note
• https://wordpress.org/plugins/addons-for-divi/#developers · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/InlineNotice/InlineNotice.php#L486 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/InfoCard/InfoCard.php#L688 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/ImageCarouselChild/ImageCarouselChild.php#L507 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/GradientHeading/GradientHeading.php#L344 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/Review/Review.php#L703 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/VideoModal/VideoModal.php#L593 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/Testimonial/Testimonial.php#L1147 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/LogoGridChild/LogoGridChild.php#L193 · Note
• https://twitter.com/CVEnew/status/1884563243412165061 · Twitter Post
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/LogoCarouselChild/LogoCarouselChild.php#L177 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/FlipBox/FlipBox.php#L1053 · Note
• https://plugins.trac.wordpress.org/changeset/3230743 · Note
• https://plugins.trac.wordpress.org/browser/addons-for-divi/trunk/includes/modules/divi-4/InfoBox/InfoBox.php#L852 · Note