CVE-2025-68867

MediumCVSS 6.5

Published: 08/01/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Effect Maker plugin (up to version 1.2.1) contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. This allows an attacker to execute malicious scripts in the context of the victim's browser.

Risk Assessment

The risk is the possibility of session hijacking, data theft, or performing unauthorized actions in the context of the victim's browser.

Recommendation

It is recommended to update the Effect Maker plugin to a version newer than 1.2.1 if available, and to implement input and output filtering to prevent XSS attacks.

Other vulnerabilities in Effect Maker

CVE-2025-62914Medium
The Effect Maker plugin by anibalwainstein contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Effect Maker from n/a through <= 1.2.1.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affects Effect Maker: from n/a through <= 1.2.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS