CVE-2025-0353 – The Divi Torque Lite WordPress plugin has a sto... (How to Fix)

Q: What is the severity of CVE-2025-0353?

CVE-2025-0353 has a CVSS score of 6.4 (MEDIUM). The Divi Torque Lite WordPress plugin has a stored cross-site scripting vulnerability that allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. These scripts execute whenever users view the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin up to version 4.1.0 are affected.

📋 TL;DR

The Divi Torque Lite WordPress plugin has a stored cross-site scripting vulnerability that allows authenticated attackers with contributor-level access or higher to inject malicious scripts into website pages. These scripts execute whenever users view the compromised pages, potentially stealing credentials or performing unauthorized actions. All WordPress sites using this plugin up to version 4.1.0 are affected.

💻 Affected Systems

Products:

Divi Torque Lite – Best Divi Addon, Extensions, Modules & Social Modules WordPress plugin

Versions: All versions up to and including 4.1.0

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the vulnerable plugin enabled. Contributor-level access or higher is needed to exploit.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal administrator credentials, deface websites, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to complete site compromise.

🟠

Likely Case

Attackers with contributor access inject malicious scripts that steal user session cookies or credentials, leading to account takeover and unauthorized content modification.

🟢

If Mitigated

With proper user access controls and content security policies, impact is limited to defacement or minor data exposure from the compromised user's context.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is technically simple once access is obtained. The vulnerability is in multiple widgets making exploitation straightforward.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.1.1 or later

Vendor Advisory: https://wordpress.org/plugins/addons-for-divi/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Divi Torque Lite' and click 'Update Now'. 4. Verify update to version 4.1.1 or higher.

🔧 Temporary Workarounds

Disable vulnerable widgets

all

Temporarily disable the FlipBox, GradientHeading, ImageCarouselChild, InfoBox, and InfoCard widgets until patching.

Implement Content Security Policy

all

Add CSP headers to restrict script execution sources and mitigate XSS impact.

Add to .htaccess: Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Add to wp-config.php: header("Content-Security-Policy: default-src 'self'; script-src 'self'");

🧯 If You Can't Patch

Remove the Divi Torque Lite plugin entirely and use alternative Divi extensions
Restrict contributor-level access to trusted users only and implement strict user role management

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for 'Divi Torque Lite' version. If version is 4.1.0 or lower, you are vulnerable.

Check Version:

wp plugin list --name='addons-for-divi' --field=version

Verify Fix Applied:

After updating, verify the plugin version shows 4.1.1 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to widget update endpoints
Suspicious JavaScript in page content or database entries
Multiple failed login attempts followed by contributor account access

Network Indicators:

Unexpected outbound connections from WordPress site to external domains
Suspicious script tags in HTTP responses

SIEM Query:

source="wordpress.log" AND ("addons-for-divi" OR "Divi Torque") AND ("update" OR "widget" OR "inject")

📊 Metadata

CVE ID: CVE-2025-0353

CVSS v3 Score: 6.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.25% exploit probability (47.5th percentile)

Published: January 29, 2025

Last Updated: January 29, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-0353, you might also want to check these: