CVE-2025-68385 HIGH

CVE-2025-68385: Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vendor Elastic
Product Kibana
Weakness CWE-79 · XSS
Published December 18, 2025
Last update December 19, 2025
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.

Key dates

02Disclosure timeline

December 18, 2025 CVE published
December 19, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-38694 WordPress Moloni plugin <= 4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-51907 WordPress WP Virtual Room Configurator plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-33276 XSS in Unified Search via Unescaped Host/Service Names CVE-2024-13679 Widget BUY.BOX <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-46924 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)