CVE-2025-68037
Published: 20 February 2026
Summary
CVE-2025-68037 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-68037 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Export Media URLs WordPress plugin by Atlas Gondal. The flaw resides in the export-media-urls component and affects all versions from unknown initial release through 2.2 inclusive. Published on 2026-02-20, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility and scope change.
Attackers can exploit this vulnerability remotely without authentication by crafting malicious payloads delivered via the plugin's URLs. Exploitation requires tricking a user—typically a site visitor or administrator—into interacting with a malicious link or page (UI:R), such as clicking in an email or phishing site. Successful attacks enable arbitrary JavaScript execution in the victim's browser context, potentially leading to low-level impacts on confidentiality (e.g., session token theft), integrity (e.g., data tampering), and availability, amplified by the changed scope (S:C) to affect the site's security context.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/export-media-urls/vulnerability/wordpress-export-media-urls-plugin-2-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the issue specifically in Export Media URLs version 2.2, providing details for WordPress administrators to assess exposure and apply mitigations, such as plugin updates or input sanitization workarounds if patches are referenced therein.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207574
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through <= 2.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables remote exploitation of web application (T1190) via crafted malicious links requiring user interaction (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of all inputs to the export-media-urls plugin before they are reflected into generated web pages, directly blocking the reflected XSS payload.
Mandates filtering or encoding of information output by the plugin so that untrusted script content cannot execute in the victim's browser context.
Deploys malicious-code detection mechanisms that can identify and block common reflected XSS payloads delivered via crafted URLs.