CVE-2025-68518

High

Published: 22 January 2026

Published

22 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0002 5.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-68518 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68518 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-Site Scripting (XSS) as classified under CWE-79. It affects the ThemeGoods Hoteller WordPress theme in all versions from an unspecified initial release through those prior to 6.8.9. Published on 2026-01-22, the issue carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.

Remote attackers require no privileges and can exploit the vulnerability over the network with low complexity, though it demands user interaction such as clicking a malicious link. Successful exploitation alters the security scope, yielding low impacts on confidentiality, integrity, and availability. This allows attackers to inject and execute arbitrary scripts in users' browsers within the Hoteller theme's context, potentially compromising victim sessions or data.

The Patchstack advisory confirms the vulnerability in the WordPress Hoteller theme and states it is fixed in version 6.8.9. Mitigation involves updating affected installations to version 6.8.9 or later.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-3997

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Hoteller hoteller allows Reflected XSS.This issue affects Hoteller: from n/a through < 6.8.9.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

Reflected XSS in public-facing WordPress theme directly enables exploitation of the web app (T1190) via malicious links requiring user interaction (T1204.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1