Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T17:17:30.320Z",
  "pubdate": "2026-09-03T17:17:30.320Z",
  "executiveSummary": "The WPKoi Templates for Elementor plugin is susceptible to a DOM-based Cross-Site Scripting (XSS) vulnerability. This security flaw stems from the improper neutralization of user-supplied input during the generation of web pages, allowing for the injection and execution of malicious scripts within a victim's browser session. The vulnerability affects versions from n/a through 3.7.2. An attacker can exploit this vulnerability by crafting a malicious URI or trigger that influences client-side scripts to process untrusted data, leading to the execution of arbitrary JavaScript. Successful exploitation may result in session hijacking, unauthorized actions performed on behalf of the user, sensitive information theft, or unauthorized redirection. Given the nature of DOM-based XSS, the vulnerability operates entirely within the client environment, bypassing server-side security filters. Remediation is required to ensure that all data rendered in the DOM is properly sanitized or validated before processing by client-side scripts.",
  "technicalDetails": "The identified vulnerability is classified as DOM-based Cross-Site Scripting (CWE-79), occurring when an application contains client-side JavaScript that processes data from an untrusted source in an unsafe manner. In the context of WPKoi Templates for Elementor (versions n/a through 3.7.2), the issue arises because the plugin's frontend scripts fail to adequately validate or encode user-controllable input before passing it to 'sinks' that can execute code or modify the document structure, such as innerHTML, document.write, or eval.\nThe attack flow for a DOM-based XSS vulnerability of this nature typically involves an attacker crafting a specific URL containing a malicious payload—often injected via a URL parameter, fragment identifier, or other client-side data sources. When a victim clicks a link or is redirected to a page containing this payload, the malicious script is transmitted to the client's browser. The vulnerable frontend JavaScript within the WPKoi Templates plugin then retrieves this data from the URL (the 'source') and processes it insecurely.\nSpecifically, the application reads the input data and subsequently injects it into the Document Object Model (DOM) without proper sanitization. Because the script execution happens entirely within the victim's browser, the malicious payload is never transmitted to the backend server, rendering standard server-side WAF rules or input sanitization ineffective. Once the payload is rendered, it executes within the context of the user's session, granting the attacker the ability to interact with the DOM, access cookies, steal session tokens, or perform actions as the authenticated user.\nThis vulnerability is classified as DOM-based because the execution flow is entirely contained within the client-side environment. It requires no specific authentication or elevated privileges to initiate, provided the attacker can convince a user to navigate to the maliciously crafted URL. The impact is significant as it compromises the integrity of the user's session and provides a vector for cross-origin data theft or account takeover. The lack of proper DOM element handling by the plugin’s frontend component remains the root cause, necessitating a comprehensive review of all client-side data handling functions to ensure that input is treated as text rather than executable markup."
}