CVE-2025-68856: 
WordPress vulnerability analysis and mitigation

CVE-2025-68856 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Mopinion Feedback Form WordPress plugin (developed by keeswolters). It affects all versions up to and including 1.1.1, with no official patch currently available. The vulnerability was reported on November 16, 2025, by researcher Skalucy and published on January 27, 2026. It carries a CVSS v3.1 base score of 7.1 (Medium/High) (Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. The attack vector is network-based, requires no authentication (unauthenticated attacker), but does require user interaction — a privileged user must perform an action such as clicking a malicious link or visiting a crafted page. The plugin fails to properly sanitize or encode user-supplied input before it is written into the DOM, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session (Patchstack).

Successful exploitation allows an attacker to inject malicious scripts — such as redirects, credential-harvesting forms, or arbitrary HTML payloads — into pages rendered by the affected WordPress site. These scripts execute in the victim's browser with the privileges of the authenticated user, potentially enabling session hijacking, cookie theft, or unauthorized administrative actions. The CVSS scope is marked as "Changed," indicating the impact extends beyond the vulnerable component to the user's browser environment (Patchstack).

No official patch is available as of the time of publication, increasing the risk window for exploitation. The EPSS score is approximately 0.029% (0.000290), indicating a relatively low but non-negligible probability of exploitation in the near term. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. No specific threat actor attribution or confirmed in-the-wild exploitation has been reported, and the vulnerability does not appear in the CISA KEV catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Mopinion Feedback Form plugin version ≤ 1.1.1 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Craft malicious payload: Construct a URL or page containing a DOM-Based XSS payload that exploits the plugin's unsanitized input handling (e.g., a crafted query parameter or fragment that the plugin writes directly into the DOM).
3. Deliver payload: Send the malicious link to a target user with elevated privileges (e.g., a WordPress administrator) via phishing email, social engineering, or embedding in a comment/forum post.
4. Trigger execution: When the victim clicks the link and loads the crafted page, the injected JavaScript executes in their browser within the context of the WordPress site.
5. Achieve objective: The attacker can steal session cookies, capture credentials, perform actions on behalf of the victim (e.g., create rogue admin accounts), or redirect the user to a malicious site (Patchstack).

• Network: Unusual outbound requests from victim browsers to attacker-controlled domains following interaction with pages using the Mopinion Feedback Form plugin; unexpected JavaScript resource loads from external origins.
• Logs: WordPress access logs showing requests to plugin-related endpoints with suspicious query parameters containing encoded JavaScript (e.g., <script>, javascript:, onerror=, URL-encoded equivalents).
• Browser/Application: Unexpected redirects or pop-ups on pages where the Mopinion Feedback Form plugin is active; reports from users of anomalous behavior after visiting feedback form pages.
• File System: Unauthorized changes to WordPress user accounts (e.g., new admin users created) or modified plugin files that may indicate post-exploitation activity.

No official patch from the plugin developer is currently available for versions ≤ 1.1.1. As an immediate mitigation, Patchstack has issued a virtual patch (WAF rule) to block exploitation attempts for users of the Patchstack service. Site administrators are advised to deactivate and remove the Mopinion Feedback Form plugin until an official fix is released. Additionally, enforcing strict Content Security Policy (CSP) headers and monitoring for suspicious DOM manipulation can reduce risk (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering January 26 – February 1, 2026, highlighting it as part of broader WordPress plugin security tracking. Patchstack, which discovered and published the vulnerability, classified it as medium priority and noted the potential for mass-exploit campaigns targeting WordPress sites. No significant additional vendor statements or notable researcher commentary beyond these sources have been identified.