What is the CVSS score of CVE-2025-68504?

CVE-2025-68504 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-68504

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-29 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 29, 2025 - 22:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows DOM-Based XSS.This issue affects JetSearch: from n/a through <= 3.5.16.

AnalysisAI

DOM-based cross-site scripting (XSS) in Crocoblock JetSearch WordPress plugin through version 3.5.16 allows attackers to inject malicious scripts into the search interface that execute in users' browsers. The vulnerability affects the plugin's web page generation when processing search input, enabling attackers to steal session tokens, redirect users, or perform actions on behalf of authenticated users without requiring authentication themselves. No CVSS score was available at analysis time, but the low EPSS score (0.04%, 14th percentile) suggests limited real-world exploitation likelihood despite the XSS vector.

Technical ContextAI

This vulnerability is a DOM-based XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the Crocoblock JetSearch plugin, a WordPress search functionality extension. DOM-based XSS occurs when untrusted user input is used to dynamically update the Document Object Model without proper sanitization or encoding, allowing attackers to inject arbitrary JavaScript code. The root cause is insufficient input validation or output encoding when the plugin processes search queries and generates dynamic HTML elements in the DOM. Unlike reflected or stored XSS, DOM-based XSS is entirely client-side and exploited through the plugin's JavaScript code interacting with the page structure.

Affected ProductsAI

Crocoblock JetSearch WordPress plugin from version 3.5.16 and earlier. The affected product is specifically identified by the CPE namespace for WordPress plugins (relating to the jet-search plugin). The vulnerability was disclosed by audit@patchstack.com and documented in the Patchstack vulnerability database.

RemediationAI

Update Crocoblock JetSearch to a version newer than 3.5.16 immediately. Check the official Crocoblock plugin repository or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/jet-search/vulnerability/wordpress-jetsearch-plugin-3-5-16-cross-site-scripting-xss-vulnerability for the latest patched release. WordPress administrators should enable automatic plugin updates if not already configured. As an interim mitigation, review and restrict user input to the search function and consider implementing Content Security Policy (CSP) headers to limit inline script execution, though these are not substitutes for patching.