Platform
wordpress
Component
javo-core
Opgelost in
3.0.1
CVE-2025-60068 describes a Code Injection vulnerability discovered in the Javo Core WordPress plugin. This flaw allows an attacker to inject and execute arbitrary code on a vulnerable system, potentially leading to complete site compromise. The vulnerability impacts versions from 0.0 up to and including 3.0.0.266, and a patch is expected to be released by the vendor.
The Code Injection vulnerability in Javo Core is particularly severe because it allows an attacker to execute arbitrary code within the context of the WordPress plugin. This means an attacker could potentially gain full control of the WordPress site, including access to sensitive data, modification of content, and installation of malicious software. Successful exploitation could lead to data breaches, website defacement, and the spread of malware. The impact is amplified if the WordPress site handles sensitive user data or is integrated with other critical systems.
As of the publication date (2025-12-18), there is no indication of active exploitation of CVE-2025-60068. Public proof-of-concept (POC) code is not currently available. The vulnerability has not been added to the CISA KEV catalog. The medium CVSS score suggests a moderate level of exploitability and impact.
WordPress websites utilizing the Javo Core plugin, particularly those running older, unpatched versions (0.0 - 3.0.0.266), are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.
• wordpress / composer / npm:
grep -r "javothemes/javo-core" /var/www/html/• wordpress / composer / npm:
wp plugin list | grep javo-core• wordpress / composer / npm:
wp plugin status javo-core• generic web: Check WordPress plugin directory for updates and security advisories related to Javo Core.
disclosure
Exploit Status
EPSS
0.06% (18% percentiel)
CISA SSVC
CVSS-vector
The primary mitigation for CVE-2025-60068 is to upgrade to a patched version of the Javo Core plugin as soon as it becomes available. Until a patch is released, consider disabling the Javo Core plugin if it is not essential. As a temporary workaround, implement strict input validation and sanitization on any user-supplied data that is processed by the plugin. Web Application Firewalls (WAFs) configured to detect and block code injection attempts can also provide a layer of protection. Monitor WordPress logs for suspicious activity related to Javo Core.
Geen bekende patch beschikbaar. Bestudeer de details van de kwetsbaarheid grondig en pas mitigaties toe op basis van de risicotolerantie van uw organisatie. Het kan het beste zijn om de getroffen software te verwijderen en een vervanging te vinden.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2025-60068 is a Code Injection vulnerability affecting the Javo Core WordPress plugin, allowing attackers to execute arbitrary code. It impacts versions 0.0 through 3.0.0.266.
You are affected if your WordPress site uses the Javo Core plugin and is running a version between 0.0 and 3.0.0.266. Check your plugin versions immediately.
Upgrade to the latest version of the Javo Core plugin as soon as a patch is released by the vendor. Until then, disable the plugin or implement strict input validation.
As of December 18, 2025, there is no confirmed active exploitation of CVE-2025-60068, but it's crucial to apply the fix promptly.
Refer to the Javo Core plugin's official website or WordPress plugin directory for the latest security advisory and patch information.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.