CVE-2025-68846
Published: 20 February 2026
Summary
CVE-2025-68846 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-68846 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Asynchronous Javascript WordPress plugin developed by Paris Holley. The plugin, known as asynchronous-javascript, is affected in all versions from n/a through 1.3.5.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by tricking authenticated or unauthenticated users into interacting with crafted input reflected in web pages, achieving low impacts on confidentiality, integrity, and availability within a changed security scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/asynchronous-javascript/vulnerability/wordpress-asynchronous-javascript-plugin-1-3-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on this Reflected XSS vulnerability specific to the WordPress Asynchronous Javascript plugin version 1.3.5. Security practitioners should consult this reference for mitigation guidance, such as updating to a patched version if available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207591
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paris Holley Asynchronous Javascript asynchronous-javascript allows Reflected XSS.This issue affects Asynchronous Javascript: from n/a through <= 1.3.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary JavaScript execution in victim browsers via malicious links (user interaction), directly mapping to JS interpreter execution and phishing/user-execution delivery vectors.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of untrusted input before web page generation, blocking the reflected XSS payload in the Asynchronous Javascript plugin.
Requires filtering of information output to web pages, preventing malicious scripts from being reflected back to users via crafted links.
Provides malicious code protection mechanisms that can detect or block script injection attempts exploiting the plugin's input handling flaw.