The vulnerability CVE-2025-68904 in jegtheme JNews - Frontend Submit plugin is a reflected Cross-site Scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute in users' browsers when they interact with the vulnerable frontend submission feature. It affects all versions up to 11.0.0. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this reflected XSS vulnerability can allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The attack requires user interaction and can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation or output encoding at the application level to mitigate reflected XSS risks. Monitor official jegtheme or JNews plugin channels for updates and patches.