This vulnerability (CVE-2025-68081) is an improper input neutralization issue (CWE-79) in WP-Polls versions up to 2.77.3. It allows an attacker with administrator privileges to inject malicious scripts during web page generation, potentially leading to cross-site scripting attacks. The CVSS 3.1 base score is 5.9 (medium), with network attack vector, low attack complexity, high privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability in a limited manner. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with administrator privileges to execute arbitrary scripts in the context of the affected site, potentially leading to limited confidentiality, integrity, and availability impacts. Because the attack requires administrator privileges and user interaction, the risk is moderated but still significant within the administrative context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit administrator access to trusted users only and exercise caution with any input or content that administrators may process. Monitor official channels for updates or patches from the vendor.