CVE-2025-68848
Published: 20 February 2026
Summary
CVE-2025-68848 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-68848 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the amr cron manager WordPress plugin (amr-cron-manager) developed by anmari. The issue impacts all versions from n/a through 2.3 inclusive. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, and changed scope.
A remote attacker without privileges can exploit this vulnerability by crafting a malicious URL that includes attacker-controlled input, tricking a user—such as a site administrator—into interacting with it (e.g., clicking the link). Upon execution in the victim's browser, the reflected XSS payload executes in the context of the WordPress site with changed scope, potentially allowing limited impacts: low confidentiality (e.g., access to some sensitive data), low integrity (e.g., minor modifications), and low availability disruptions.
Patchstack advisories document the vulnerability in the amr-cron-manager plugin up to version 2.3, providing details on the Reflected XSS issue; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/amr-cron-manager/vulnerability/wordpress-amr-cron-manager-plugin-2-3-reflecte-dcross-site-scripting-xss-vulnerability?_s_id=cve for mitigation guidance, such as updating to a patched version if available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207589
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anmari amr cron manager amr-cron-manager allows Reflected XSS.This issue affects amr cron manager: from n/a through <= 2.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables web app exploitation (T1190) and arbitrary JavaScript execution in victim browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted input before it is used in web page generation, blocking the reflected XSS payload in amr-cron-manager.
Requires filtering of information output by the application to remove or encode script content, preventing execution of attacker-supplied reflected XSS in the victim's browser.
Enables monitoring of web requests and anomalous input patterns that could indicate attempts to exploit the reflected XSS flaw in the plugin.