Cyber Resilience

CVE-2025-68501

High

Published: 20 February 2026

Published
20 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0004 14.4th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-68501 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-68501 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the Mollie Payments for WooCommerce WordPress plugin (mollie-payments-for-woocommerce), impacting all versions from n/a through 8.1.1 inclusive. The vulnerability was published on 2026-02-20T16:22:10.100 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction such as clicking a malicious link. Exploitation occurs in a changed scope, allowing limited impacts on confidentiality, integrity, and availability, typically enabling theft of user session data, cookies, or execution of scripts in the victim's browser context within the affected site's domain.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/mollie-payments-for-woocommerce/vulnerability/wordpress-mollie-payments-for-woocommerce-plugin-8-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents this Reflected XSS issue in Mollie Payments for WooCommerce up to version 8.1.1, recommending updates to newer versions where the vulnerability is addressed.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mollie Mollie Payments for WooCommerce mollie-payments-for-woocommerce allows Reflected XSS.This issue affects Mollie Payments for WooCommerce: from n/a through <= 8.1.1.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Reflected XSS in public-facing WooCommerce plugin directly enables exploitation of a web application (T1190) for session/cookie theft or script execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2021-47873Shared CWE-79
CVE-2026-7052Shared CWE-79
CVE-2024-56060Shared CWE-79
CVE-2025-49043Shared CWE-79
CVE-2026-40038Shared CWE-79
CVE-2024-56022Shared CWE-79
CVE-2025-68889Shared CWE-79
CVE-2026-1074Shared CWE-79
CVE-2025-22539Shared CWE-79
CVE-2025-22286Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation and neutralization of untrusted input before it is used in web page generation, directly blocking the reflected XSS payload in the Mollie plugin.

SI-15 Information Output Filtering good match
prevent

Mandates filtering or encoding of information outputs to remove or neutralize script content, preventing reflected XSS from executing in the victim's browser.

SI-3 Malicious Code Protection partial match
preventdetect

Provides mechanisms to detect and block malicious code (scripts) delivered via the reflected XSS vector before or during execution.

References