What is the CVSS score of CVE-2025-68598?

CVE-2025-68598 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-68598

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-24 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

5.4 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 24, 2025 - 13:16 nvd

MEDIUM 5.4

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiveComposer Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through <= 2.1.11.

AnalysisAI

Stored cross-site scripting (XSS) in Live Composer page builder plugin for WordPress (versions through 2.1.11) allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users viewing affected pages. An attacker with contributor or editor access can store XSS payloads that persist in the database and execute when administrators or other site visitors interact with the affected content, potentially leading to session hijacking, credential theft, or malware distribution.

Technical ContextAI

Live Composer (live-composer-page-builder) is a WordPress page builder plugin that processes user-generated page content. The vulnerability stems from improper input sanitization and output encoding during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin fails to adequately neutralize user-supplied input containing JavaScript code before rendering it in the page editor or frontend display. Unlike reflected XSS which requires social engineering to distribute a malicious link, stored XSS persists in the WordPress database, making it a more severe threat vector affecting multiple users across multiple sessions.

Affected ProductsAI

Live Composer Page Builder (live-composer-page-builder) WordPress plugin versions from an unspecified baseline through and including version 2.1.11. The plugin is distributed through the WordPress plugin repository and installed on WordPress sites as a page builder tool. Administrators should verify their installed version against the affected range; the vendor advisory at patchstack.com provides detailed version information and affected component scope.

RemediationAI

Update the Live Composer page builder plugin to the latest patched version released after 2.1.11, as confirmed in the vendor security advisory at patchstack.com/database/Wordpress/Plugin/live-composer-page-builder. Site administrators should immediately update all affected installations through the WordPress plugin management interface. As an interim mitigation, restrict page builder access to trusted administrator-level users only by adjusting WordPress user role capabilities, reducing the attack surface to authenticated contributors and editors who might inject XSS payloads. Review any pages created or edited by lower-privilege users for suspicious JavaScript or iframe injection before the patch is applied.