What is the CVSS score of CVE-2025-68836?

CVE-2025-68836 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-68836?

A reflected cross-site scripting vulnerability in the Table of Contents Creator WordPress plugin (versions through 1.6.4.1) could allow attackers to inject malicious scripts that compromise user…

How to fix or mitigate CVE-2025-68836?

Within 24 hours: Inventory all WordPress installations and identify those running the Table of Contents Creator plugin; notify affected site administrators and document current versions. Within 7 days: Deactivate and remove the plugin from all installations, or implement WAF rules to block XSS payloads targeting the vulnerable parameter; test any workarounds in a staging environment first. Within 30 days: Monitor Patchstack and plugin repositories for security patches; establish a process to evaluate plugin security before deployment and maintain an inventory of all active plugins with version tracking.

Wordpress Plugin CVE-2025-68836

EUVD-2025-208867 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 09:22 euvd

EUVD-2025-208867

Analysis Generated

Mar 19, 2026 - 09:22 vuln.today

CVE Published

Mar 19, 2026 - 09:16 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markbeljaars Table of Contents Creator allows Reflected XSS.This issue affects Table of Contents Creator: from n/a through 1.6.4.1.

AnalysisAI

A reflected cross-site scripting (XSS) vulnerability exists in the Table of Contents Creator WordPress plugin that allows attackers to inject malicious scripts into web pages. The vulnerability affects all versions through 1.6.4.1 and can be exploited remotely without authentication, though it requires user interaction. With a CVSS score of 7.1 and a changed scope, this represents a moderate severity issue reported by Patchstack's audit team.

Technical ContextAI

This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a fundamental input validation flaw where user-supplied data is incorporated into HTML output without proper sanitization or encoding. The Table of Contents Creator plugin for WordPress fails to properly validate and sanitize input parameters before reflecting them back in HTTP responses, allowing attackers to inject arbitrary JavaScript code. The reflected XSS variant means the malicious payload is not stored persistently but must be delivered to victims through crafted URLs or forms. The CVSS vector indicates network-based exploitation (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but necessitating user interaction (UI:R), with a changed scope (S:C) meaning the vulnerable component impacts resources beyond its security scope.

RemediationAI

Upgrade the Table of Contents Creator plugin to a version newer than 1.6.4.1 that addresses this vulnerability, checking the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/table-of-contents-creator/vulnerability/wordpress-table-of-contents-creator-plugin-1-6-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve for the specific patched version. If an immediate update is not feasible, consider temporarily disabling the plugin until a patch can be applied, or implement Web Application Firewall (WAF) rules to filter potentially malicious input parameters associated with the plugin's functionality. Organizations should also review user education programs to minimize the risk of users clicking suspicious links, and implement Content Security Policy (CSP) headers to mitigate the impact of successful XSS attacks.