What is the CVSS score of CVE-2025-68977?

CVE-2025-68977 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

DesignThemes Portfolio Addon CVE-2025-68977

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2025-12-30 audit@patchstack.com

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Requires low-privileged user interaction, no special auth beyond contributor.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:52 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through <= 1.5.

AnalysisAI

Cross-site scripting (XSS) vulnerability in the DesignThemes Portfolio Addon WordPress plugin through version 1.5 allows authenticated users with contributor-level privileges to inject and execute arbitrary web scripts via DOM manipulation. An attacker can craft malicious portfolio content that triggers script execution when another user (such as an admin) views the affected page, potentially leading to session hijacking, credential theft, or site defacement. No active exploitation or public exploit code has been identified at this time.

Technical ContextAI

The vulnerability is a DOM-based cross-site scripting (XSS) flaw, classified under CWE-79. It affects the DesignThemes Portfolio Addon plugin for WordPress, a tool used to display portfolio items. The root cause is improper neutralization of user-supplied input during web page generation, allowing script injection that executes in the browser's DOM context. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates the attack is network-based with low complexity, requires low authentication (e.g., contributor role), needs user interaction, and has a scope change meaning the injected script can affect resources beyond the vulnerable component.

Affected ProductsAI

The affected product is the DesignThemes Portfolio Addon plugin for WordPress, versions from n/a up to and including 1.5. The vulnerability exists in all versions prior to the fix. A CPE string is not provided in the input but would likely be cpe:2.3:a:designthemes:portfolio_addon:*:*:*:*:*:wordpress:*:*: Software versions <= 1.5. The vendor advisory and further details are available via the Patchstack database at https://patchstack.com/database/Wordpress/Plugin/designthemes-portfolio-addon/vulnerability/wordpress-designthemes-portfolio-addon-plugin-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve.

RemediationAI

Upgrade the DesignThemes Portfolio Addon plugin to version 1.6 or later, which contains the vendor-released patch. The advisory from Patchstack (referenced in the input) likely provides the fixed version number. No official workarounds have been published; however, as a compensating control, administrators can restrict contributor-level user permissions or implement a Web Application Firewall (WAF) with XSS detection rules, though these may have false positives and do not address the root cause. The primary and most effective action is to update the plugin immediately.