What is the CVSS score of CVE-2025-68499?

CVE-2025-68499 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-68499

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-30 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 30, 2025 - 00:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.12.

AnalysisAI

DOM-based cross-site scripting (XSS) in Crocoblock JetTabs WordPress plugin versions up to 2.2.12 allows attackers to inject malicious scripts that execute in users' browsers when viewing affected pages. The vulnerability stems from improper input neutralization during web page generation, enabling stored or reflected XSS attacks without requiring authentication. With an EPSS score of 0.04% (14th percentile), exploitation likelihood is very low despite the publicly documented vulnerability.

Technical ContextAI

The vulnerability is a DOM-based XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the JetTabs plugin, a WordPress component for creating tabbed content interfaces. DOM-based XSS occurs when user-controlled input is processed by client-side JavaScript and inserted into the DOM without proper sanitization or encoding, allowing attackers to execute arbitrary JavaScript in the context of the affected website. The vulnerability affects the jet-tabs plugin (WordPress plugin namespace) across all versions from release through 2.2.12, indicating the flaw has existed in the codebase for an extended period without remediation.

Affected ProductsAI

Crocoblock JetTabs plugin for WordPress (WordPress plugin identifier: jet-tabs) is affected in all versions from initial release through version 2.2.12 inclusive. The vulnerability documentation and advisory are available at https://patchstack.com/database/Wordpress/Plugin/jet-tabs/vulnerability/wordpress-jettabs-plugin-2-2-12-cross-site-scripting-xss-vulnerability?_s_id=cve via Patchstack's vulnerability database.

RemediationAI

Users should upgrade the JetTabs plugin to a version newer than 2.2.12 immediately; the vendor advisory at Patchstack should be consulted for the specific patched version number and upgrade instructions. In the interim, website administrators should restrict JetTabs functionality to trusted content sources only and avoid allowing user-generated content in tabbed sections. WordPress security plugins with input filtering capabilities can provide limited mitigation by sanitizing form submissions before they reach the plugin. Website administrators should also audit any existing user-submitted data that may have been processed by vulnerable versions and remove any suspicious content.