CVE-2025-68880

High

Published: 20 February 2026

Published

20 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0004 14.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-68880 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-68880 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79, in the Simple Archive Generator WordPress plugin developed by peterwsterling. This issue affects the plugin from unknown initial versions through version 5.2 inclusive. Published on 2026-02-20, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity by tricking an authenticated user into interacting with malicious input, such as a crafted URL or form submission. Exploitation requires user interaction but results in changed scope, allowing limited impacts: low confidentiality (e.g., potential exposure of sensitive data in the victim's session), low integrity (e.g., modification of page content), and low availability.

The Patchstack advisory provides further details on this vulnerability at https://patchstack.com/database/Wordpress/Plugin/simple-archive-generator/vulnerability/wordpress-simple-archive-generator-plugin-5-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, including recommended mitigation steps.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-207596

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Reflected XSS.This issue affects Simple Archive Generator: from n/a through <= 5.2.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

Why these techniques?

Reflected XSS via crafted URL directly requires user interaction with malicious link (T1204.001) and enables browser session hijacking through script execution in victim context (T1185).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1