CVE-2025-3058: Xelion Webchat <= 9.1.0 - Authenticated (Subscriber+) Arbitrary Options Update
First published: Thu Apr 24 2025(Updated: )
The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_settings() function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xelion Webchat plugin for WordPress | <=9.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3058?
CVE-2025-3058 has a high severity rating due to its potential for privilege escalation.
How do I fix CVE-2025-3058?
To fix CVE-2025-3058, update the Xelion Webchat plugin for WordPress to version 9.1.1 or higher.
Who is affected by CVE-2025-3058?
CVE-2025-3058 affects all versions of the Xelion Webchat plugin for WordPress up to and including version 9.1.0.
What type of vulnerability is CVE-2025-3058?
CVE-2025-3058 is a vulnerability characterized by unauthorized modification of data due to a missing capability check.
Can CVE-2025-3058 lead to data breaches?
Yes, CVE-2025-3058 can potentially lead to data breaches by allowing unauthorized access to sensitive settings.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/xelion
- canonical/xelion webchat plugin for wordpress