CVE-2025-68889

Vulnerability

Description The Pinpoll plugin for WordPress suffers from a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user input during web page generation. Versions up to and including 4.0.0 are affected [1].

Exploitation

Details The vulnerability is classified as reflected XSS, meaning it does not require authentication but does require user interaction. An attacker can craft a malicious link that, when clicked by a privileged user (such as an administrator), injects arbitrary JavaScript into the application. This can be used to perform actions on behalf of the victim or steal sensitive information [1].

Impact

Successful exploitation allows the attacker to execute malicious scripts in the context of the vulnerable site. This could lead to redirects, displaying advertisements, or injecting other HTML payloads that execute when visitors access the site. The CVSS score of 7.1 indicates a high severity, and the vulnerability is expected to be exploited in mass campaigns [1].

Mitigation

The vendor has not yet released a patch, but Patchstack provides a mitigation rule to block attacks until an official fix is available. Users are advised to update the plugin as soon as a patch is released, or contact their hosting provider for assistance [1].