Stored XSS Vulnerability in Synergy Project Manager by cjjparadoxmax
CVE-2025-68898

5.8MEDIUM

Key Information:

Vendor

WordPress
Status
Synergy Project Manager
Vendor
CVE Published:
22 January 2026

What is CVE-2025-68898?

The Synergy Project Manager by cjjparadoxmax is susceptible to a Stored Cross-site Scripting vulnerability, which allows attackers to inject malicious scripts into web pages viewed by other users. This vulnerability can compromise the integrity of user data and lead to unauthorized actions, potentially affecting the overall security of the application. Users running versions of Synergy Project Manager up to and including 1.5 should take immediate action to mitigate the risk.

Affected Version(s)

Synergy Project Manager 0 <= 1.5

References

https://patchstack.com/database/Wordpress/Plugin/synergy-...
vdb-entry

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mcdruid | Patchstack Bug Bounty Program
.