What is the CVSS score of CVE-2025-68885?

CVE-2025-68885 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-68885

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-31 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 06:15 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in page-carbajal Custom Post Status custom-post-status allows Stored XSS.This issue affects Custom Post Status: from n/a through <= 1.1.0.

AnalysisAI

Cross-site request forgery (CSRF) vulnerability in the WordPress Custom Post Status plugin up to version 1.1.0 enables attackers to perform unauthorized actions on behalf of authenticated administrators, potentially leading to stored cross-site scripting (XSS) attacks. The CSRF protection bypass allows unauthenticated attackers to craft malicious requests that, when clicked by an admin, result in persistent JavaScript injection into the WordPress database. This is a chained vulnerability where CSRF-enabled request forgery leads to XSS payload storage.

Technical ContextAI

The Custom Post Status WordPress plugin (identified by CPE references to wordpress-plugin-custom-post-status) fails to implement adequate CSRF token validation (CWE-352) in its administrative functionality. The root cause is insufficient nonce verification on sensitive endpoints that handle post status modifications. When an admin visits a malicious site containing a crafted request, the browser automatically includes their WordPress session cookies, allowing the attacker's request to execute in the admin's security context. The vulnerability is compounded by insufficient input sanitization in the status-handling code, permitting JavaScript payloads to be stored in post metadata or custom fields without proper escaping. This stored XSS payload is then rendered to other administrators or site visitors, creating a persistent attack vector.

Affected ProductsAI

The Custom Post Status WordPress plugin is affected in all versions from the initial release through version 1.1.0 inclusive. This plugin is available via the WordPress plugin repository and is referenced in the Patchstack vulnerability database. No specific CPE string distinguishing major/minor versions within the 0.x and 1.x ranges is provided, but the vulnerability affects any installation using this plugin up to and including the 1.1.0 release.

RemediationAI

Update the Custom Post Status plugin to a version beyond 1.1.0 (exact patched version not specified in provided intelligence; check the official WordPress plugin repository or Patchstack advisory for the next available release). Immediate remediation should also include disabling the plugin if an updated version is unavailable and a patched release timeline is unclear. Additionally, review any post status changes or custom fields modified by untrusted users during the vulnerability window, and audit WordPress user activity logs for anomalous admin actions. Verify that nonce fields are properly generated and validated on all admin-facing forms, and ensure all user input related to post status modifications is properly sanitized and escaped before storage or output. Refer to https://patchstack.com/database/Wordpress/Plugin/custom-post-status/ for the latest advisory and patched version details.