The vulnerability CVE-2025-68504 affects Crocoblock JetSearch plugin versions up to 3.5.16. It is a DOM-based Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 6.5, indicating medium severity. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation of this vulnerability can result in partial compromise of confidentiality, integrity, and availability of the affected web application. Because it is a DOM-based XSS, it can be used to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, data manipulation, or denial of service. However, exploitation requires user interaction and low privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying workarounds if provided by the vendor or restrict access to the affected plugin. Monitor vendor communications for updates on patches or official mitigations.