Cyber Resilience

CVE-2025-26868

High

Published: 25 February 2025

Published
25 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0011 29.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26868 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-26868 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Fast Flow fast-flow-dashboard WordPress plugin. This issue affects all versions of Fast Flow from n/a through 1.2.16. The vulnerability was published on 2025-02-25 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. Upon successful exploitation, adversaries can inject and execute arbitrary scripts in the victim's browser context due to the changed scope (S:C), potentially compromising low levels of confidentiality, integrity, and availability, such as session hijacking or data theft from the affected user.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/fast-flow-dashboard/vulnerability/wordpress-fast-flow-plugin-1-2-16-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fastflow Fast Flow fast-flow-dashboard allows Reflected XSS.This issue affects Fast Flow: from n/a through <= 1.2.16.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
Why these techniques?

Reflected XSS directly enables arbitrary JavaScript execution in the victim's browser (T1059.007) via client application exploitation (T1203) and facilitates session hijacking through cookie theft (T1539).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-13626Shared CWE-79
CVE-2025-24028Shared CWE-79
CVE-2025-22733Shared CWE-79
CVE-2026-27627Shared CWE-79
CVE-2026-21361Shared CWE-79
CVE-2026-9971Shared CWE-79
CVE-2025-24410Shared CWE-79
CVE-2024-53387Shared CWE-79
CVE-2025-25187Shared CWE-79
CVE-2026-40283Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-15 Information Output Filtering good match
prevent

Directly mitigates reflected XSS by requiring output filtering to prevent injection of arbitrary scripts during web page generation in the victim's browser.

SI-10 Information Input Validation good match
prevent

Enforces input validation at entry points to neutralize untrusted user input before it is reflected in dynamically generated web pages.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of the specific improper neutralization flaw in Fast Flow plugin versions through 1.2.16.

References