CVE-2025-68499 describes a DOM-based Cross-site Scripting (XSS) vulnerability in Crocoblock JetTabs plugin affecting versions up to 2.2.12. The issue arises from improper neutralization of input during web page generation, enabling an attacker with low privileges and requiring user interaction to execute script code in the context of the victim's browser. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated as medium severity with limited confidentiality, integrity, and availability impacts.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid exposing vulnerable versions in untrusted environments and monitor for updates from Crocoblock to apply official fixes once released.