CVE-2025-68904
Published: 22 January 2026
Summary
CVE-2025-68904 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-68904 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the jegtheme JNews - Frontend Submit plugin (jnews-frontend-submit) for WordPress. This issue affects all versions of the plugin from an unspecified initial release through 11.0.0. The vulnerability was published on 2026-01-22 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges but user interaction, such as clicking a malicious link that triggers the reflected payload. Exploitation changes the security scope, enabling arbitrary script execution in the victim's browser context, with low impacts on confidentiality, integrity, and availability, such as potential session hijacking or data theft from the affected site.
Patchstack's advisory documents the vulnerability in the JNews Frontend Submit plugin at https://patchstack.com/database/Wordpress/Plugin/jnews-frontend-submit/vulnerability/wordpress-jnews-frontend-submit-plugin-11-0-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, where practitioners can find details on affected versions and recommended mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3972
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews - Frontend Submit jnews-frontend-submit allows Reflected XSS.This issue affects JNews - Frontend Submit: from n/a through <= 11.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of internet-facing web apps (T1190) and facilitates browser session hijacking via injected scripts (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted web inputs to block the reflected XSS payloads that the plugin fails to neutralize.
Requires filtering or encoding of information returned in web responses, preventing the plugin's unsanitized output from executing attacker scripts in the victim's browser.
Provides malicious-code detection and blocking mechanisms that can identify or stop reflected script payloads before or during execution.