Platform
wordpress
Component
javo-core
Fixed in
3.0.1
CVE-2025-60068 describes a Code Injection vulnerability discovered in the Javo Core WordPress plugin. This flaw allows an attacker to inject and execute arbitrary code on a vulnerable system, potentially leading to complete site compromise. The vulnerability impacts versions from 0.0 up to and including 3.0.0.266, and a patch is expected to be released by the vendor.
The Code Injection vulnerability in Javo Core is particularly severe because it allows an attacker to execute arbitrary code within the context of the WordPress plugin. This means an attacker could potentially gain full control of the WordPress site, including access to sensitive data, modification of content, and installation of malicious software. Successful exploitation could lead to data breaches, website defacement, and the spread of malware. The impact is amplified if the WordPress site handles sensitive user data or is integrated with other critical systems.
As of the publication date (2025-12-18), there is no indication of active exploitation of CVE-2025-60068. Public proof-of-concept (POC) code is not currently available. The vulnerability has not been added to the CISA KEV catalog. The medium CVSS score suggests a moderate level of exploitability and impact.
Exploit Status
EPSS
0.06% (18% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-60068 is to upgrade to a patched version of the Javo Core plugin as soon as it becomes available. Until a patch is released, consider disabling the Javo Core plugin if it is not essential. As a temporary workaround, implement strict input validation and sanitization on any user-supplied data that is processed by the plugin. Web Application Firewalls (WAFs) configured to detect and block code injection attempts can also provide a layer of protection. Monitor WordPress logs for suspicious activity related to Javo Core.
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-60068 is a Code Injection vulnerability affecting the Javo Core WordPress plugin, allowing attackers to execute arbitrary code. It impacts versions 0.0 through 3.0.0.266.
You are affected if your WordPress site uses the Javo Core plugin and is running a version between 0.0 and 3.0.0.266. Check your plugin versions immediately.
Upgrade to the latest version of the Javo Core plugin as soon as a patch is released by the vendor. Until then, disable the plugin or implement strict input validation.
As of December 18, 2025, there is no confirmed active exploitation of CVE-2025-60068, but it's crucial to apply the fix promptly.
Refer to the Javo Core plugin's official website or WordPress plugin directory for the latest security advisory and patch information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.