CVE-2025-68836
Published: 19 March 2026
Summary
CVE-2025-68836 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Filters information output prior to rendering web pages, directly neutralizing injected scripts in reflected XSS attacks within the Table of Contents Creator plugin.
Validates and sanitizes user inputs to the plugin, preventing malicious script payloads from being processed and reflected back to victims' browsers.
Mandates timely patching of the specific XSS flaw in Table of Contents Creator versions through 1.6.4.1 to remediate improper input neutralization.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation via malicious links (T1566.002) that trigger arbitrary JavaScript execution (T1059.007) in victim browsers; maps to initial access against exposed web apps (T1190).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markbeljaars Table of Contents Creator table-of-contents-creator allows Reflected XSS.This issue affects Table of Contents Creator: from n/a through <= 1.6.4.1.
Deeper analysisAI
CVE-2025-68836 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Table of Contents Creator WordPress plugin by Markbeljaars. This issue affects the plugin from unknown initial versions through 1.6.4.1 and was published on 2026-03-19.
The vulnerability can be exploited by remote attackers over the network (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), but necessitating user interaction (UI:R), such as clicking a malicious link. Exploitation changes scope (S:C) and enables low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), yielding a CVSS v3.1 base score of 7.1. Attackers can inject and execute malicious scripts in users' browsers within the plugin's context.
The Patchstack advisory documents this vulnerability in the Table of Contents Creator WordPress plugin and provides related mitigation guidance at https://patchstack.com/database/Wordpress/Plugin/table-of-contents-creator/vulnerability/wordpress-table-of-contents-creator-plugin-1-6-4-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)