CVE-2025-68004
Published: 22 January 2026
Summary
CVE-2025-68004 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-68004 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the My Post Order WordPress plugin by Kapil Chugh. This issue affects the plugin from unknown initial versions through 1.2.1.1.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable over the network with low attack complexity, no required privileges, but user interaction is necessary. Any unauthenticated attacker can craft malicious input that reflects back to victims via the web page, potentially leading to execution of arbitrary scripts in the user's browser context, with low impacts on confidentiality, integrity, and availability due to the changed scope.
Patchstack has published details on the vulnerability in their database for the My Post Order WordPress plugin version 1.2.1.1, available at https://patchstack.com/database/Wordpress/Plugin/my-posts-order/vulnerability/wordpress-my-post-order-plugin-1-2-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4020
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kapil Chugh My Post Order my-posts-order allows Reflected XSS.This issue affects My Post Order: from n/a through <= 1.2.1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables T1190 by allowing crafted malicious links to execute arbitrary scripts in victim browsers after exploiting the input neutralization flaw.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of untrusted input before it is used in web page generation, blocking the reflected XSS payload at its source.
Requires filtering or encoding of information sent to users, preventing malicious scripts from being reflected and executed in the victim's browser context.
Provides mechanisms to detect and block malicious code (including script payloads) delivered via web requests or responses.