What is the CVSS score of CVE-2025-68840?

CVE-2025-68840 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of iRobots.txt SEO are affected by CVE-2025-68840?

The iRobots.txt SEO WordPress plugin (versions 1.1.2 and earlier) contains a reflected cross-site scripting vulnerability allowing attackers to craft malicious links that, when clicked by WordPress…

How to fix or mitigate CVE-2025-68840?

Within 24 hours: immediately deactivate the iRobots.txt SEO plugin on all WordPress installations; alert administrators to avoid clicking unknown links. Within 7 days: audit administrator account activity and audit logs for unauthorized changes; force password reset for all WordPress administrator accounts; implement or strengthen Content Security Policy headers. Within 30 days: evaluate alternative SEO plugins without disclosed vulnerabilities; monitor Patchstack advisory for any released patch and test/deploy immediately upon availability; implement multi-factor authentication for all administrator accounts.

iRobots.txt SEO CVE-2025-68840

EUVD-2025-210160 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-j8hq-7m8x-ppmc

WordPress XSS Wordpress Plugin Irobots Txt Seo

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS reachable over the network with no auth (PR:N) but requiring victim click (UI:R); scope changes to the WordPress origin with low CIA impact via session abuse.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:43 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.

AnalysisAI

Reflected cross-site scripting in the iRobots.txt SEO WordPress plugin (versions 1.1.2 and earlier) allows remote unauthenticated attackers to inject malicious JavaScript that executes in a victim's browser when they interact with a crafted link. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.1 driven by a scope change, though no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. Exploitation requires user interaction, which limits mass-scale weaponization but makes it viable for targeted phishing against WordPress administrators.

Technical ContextAI

The affected component is iRobots.txt SEO, a WordPress plugin developed by Mark Beljaars (CPE cpe:2.3:a:markbeljaars:irobots.txt_seo) that helps site owners manage robots.txt directives for search engine optimization. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a reflected XSS where attacker-controlled input echoed back in an HTTP response is not properly encoded before being rendered in the DOM. Because WordPress plugins run inside the same origin as the host site, injected scripts inherit the trust boundary of the WordPress application and can interact with logged-in session state.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory does not cite a fixed version, so WordPress administrators running iRobots.txt SEO 1.1.2 or earlier should monitor https://patchstack.com/database/wordpress/plugin/irobotstxt-seo/vulnerability/wordpress-irobots-txt-seo-plugin-1-1-2-reflected-cross-site-scripting-xss-vulnerability for an updated release. Until a fix ships, the most direct compensating control is to deactivate and remove the plugin entirely (trade-off: loss of the plugin's robots.txt management UI, which can be replaced by editing robots.txt manually or via another maintained SEO plugin). As interim controls, deploy a WordPress-aware web application firewall such as Patchstack, Wordfence, or Sucuri with XSS rules enabled to filter reflected script payloads in query parameters, and instruct administrators not to click external links that target the WordPress admin domain.