CVE-2025-68978

Vulnerability

Overview The DesignThemes Core plugin for WordPress, versions up to and including 1.6, is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack. This stems from improper neutralization of user input during web page generation, enabling attackers to inject arbitrary JavaScript code that executes in the browser context.

Exploitation

Details Exploitation requires a privileged user (e.g., admin) to interact with a crafted link or form. The attack is user-initiated, meaning the target must click a malicious link or visit a specially crafted page. Given the DOM-based nature, the payload manipulates the client-side environment without server-side reflection. [1]

Impact

Successful exploitation allows an attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads. These execute when any user visits the affected site, potentially leading to data theft, session hijacking, or defacement.

Mitigation

Users are strongly advised to update the plugin to a patched version beyond 1.6. If immediate update is not possible, consult your hosting provider or web developer for alternative mitigations. [1]