CVE-2025-22314
Published: 13 January 2025
Summary
CVE-2025-22314 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22314 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WordPress plugin Food Store – Online Food Delivery & Pickup (food-store). This issue affects the plugin from unknown initial versions through version 1.5.4 inclusive. The vulnerability was published on 2025-01-13 and carries a CVSS v3.1 base score of 7.1.
Attackers can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), such as clicking a malicious link. The changed scope (S:C) enables impacts on other users or resources, resulting in low confidentiality (C:L), integrity (I:L), and availability (A:L) effects, typically allowing theft of session cookies, defacement, or limited script execution in the victim's browser context.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/food-store/vulnerability/wordpress-food-store-plugin-1-5-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides further details on the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2714
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Scripts Food Store – Online Food Delivery & Pickup food-store allows Reflected XSS.This issue affects Food Store – Online Food Delivery & Pickup: from n/a through <=…
more
1.5.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of a web application (T1190) via malicious links.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses reflected XSS by requiring filtering or encoding of user inputs prior to inclusion in dynamically generated web pages, preventing script execution in victims' browsers.
Enforces validation of untrusted inputs to the Food Store plugin, rejecting or sanitizing malicious payloads that could be reflected as executable scripts.
Mandates timely remediation of the specific flaw in Food Store plugin versions through 1.5.4 via patching or upgrades to eliminate the improper neutralization vulnerability.