CVE-2025-68845
Reflected XSS in eDS Responsive Menu Plugin
Publication date: 2026-02-20
Last updated on: 2026-02-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| athemeart | eds_responsive_menu | From 1.0 (inc) to 1.2 (inc) |
| athemeart | eds_responsive_menu | to 1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68845 is a medium priority Cross Site Scripting (XSS) vulnerability affecting the WordPress eDS Responsive Menu Plugin versions 1.2 and below.
This vulnerability allows an attacker to inject malicious scripts—such as redirects, advertisements, or other HTML payloads—into a website, which execute when visitors access the site.
Exploitation requires user interaction by a privileged user performing actions like clicking a malicious link, visiting a crafted page, or submitting a form.
The vulnerability falls under the OWASP Top 10 category A3: Injection and is classified specifically as Cross Site Scripting (XSS).
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to inject malicious scripts into your website.
- Injected scripts can perform unwanted redirects.
- Attackers can display unauthorized advertisements.
- Other harmful HTML payloads can be executed, potentially compromising user data or site integrity.
Successful exploitation depends on privileged user interaction, such as clicking malicious links or submitting crafted forms.
No official patch is currently available, but mitigation rules exist to block attacks temporarily.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability is a Reflected Cross Site Scripting (XSS) issue affecting the eDS Responsive Menu WordPress plugin versions 1.2 and below. Detection typically involves monitoring for suspicious input that is improperly neutralized and reflected in web pages.'}, {'type': 'paragraph', 'content': 'While no specific detection commands are provided, common approaches include using web vulnerability scanners that test for reflected XSS by injecting typical XSS payloads into input fields or URL parameters and observing if they are executed.'}, {'type': 'list_item', 'content': 'Use tools like OWASP ZAP or Burp Suite to scan the website for reflected XSS vulnerabilities.'}, {'type': 'list_item', 'content': "Manually test URL parameters or form inputs by injecting simple XSS payloads such as: <script>alert('XSS')</script> and checking if the script executes."}] [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, immediate mitigation involves applying protective measures to block attacks.
- Implement the mitigation rule provided by Patchstack to block attack attempts targeting this vulnerability.
- Use automated protection tools or web application firewalls (WAFs) that can detect and block reflected XSS payloads.
- Educate privileged users to avoid clicking on suspicious links or visiting untrusted pages that could exploit this vulnerability.
Monitor for updates from the plugin developer or Patchstack for an official patch and apply it as soon as it becomes available.