CVE-2025-68883CWE-79

WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Reflected Cross Site Scripting (XSS) vulnerability

High · published January 22, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

⚡ A mischievous trickster could unleash a crafty XSS exploit with just a single URL! With a vulnerable bidorbuy Store Integrator from versions up to 2.12.0, the stakes are definitely high! 🔥 Think of this like a restaurant that accepts any order without checking for allergies. When a malicious customer sends a sneaky request, they can mix in harmful ingredients that affect everyone at the table! If an attacker takes advantage of this reflected XSS vulnerability, they could inject scripts into the web pages viewed by unsuspecting users. This could lead to stolen sensitive information, defacement of the site, or some seriously embarrassing pranks!

Put simply

Think of this like a restaurant that accepts any order without checking for allergies. When a malicious customer sends a sneaky request, they can mix in harmful ingredients that affect everyone at the table! This reflected XSS vulnerability occurs because the application does not properly neutralize input during web page generation, allowing harmful scripts to run when users click on crafted links.

What to do

If an attacker takes advantage of this reflected XSS vulnerability, they could inject scripts into the web pages viewed by unsuspecting users. This could lead to stolen sensitive information, defacement of the site, or some seriously embarrassing pranks! To safeguard against this, promptly update your bidorbuy Store Integrator to version 2.12.1 or later. Additionally, implement a strong Content Security Policy (CSP) and ensure that all user inputs are validated and sanitized! You've got this! With these steps, you'll keep your users safe and your reputation intact! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-01-22T16:52Z
EPSS history
Timeline
  • 22 JAN 16:52Z
    WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Reflected Cross Site Scripting (XSS) vulnerability
    cvelistv5