CVE-2025-22331
Published: 09 January 2025
Summary
CVE-2025-22331 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 46.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22331 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the P3JX Cf7Save Extension (cf7save-extension) WordPress plugin, impacting all versions from n/a through 1. The issue was published on 2025-01-09.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by tricking authenticated or unauthenticated users into interacting with crafted input reflected in web pages, achieving limited impacts on confidentiality, integrity, and availability within a changed security scope, such as session token theft or malicious script execution in the victim's browser.
The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/cf7save-extension/vulnerability/wordpress-cf7save-extension-plugin-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2731
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in P3JX Cf7Save Extension cf7save-extension allows Reflected XSS.This issue affects Cf7Save Extension: from n/a through <= 1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS directly enables browser script execution (T1059.007) and facilitates session hijacking/cookie theft (T1185, T1539) via malicious links.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly addresses the improper neutralization of input by requiring validation of web inputs to block malicious payloads used in reflected XSS attacks.
SI-15 prevents reflected XSS by filtering and encoding information outputs before rendering in web pages, neutralizing script injection.
SI-2 mandates identifying, reporting, and remediating flaws such as this XSS vulnerability in the Cf7Save WordPress plugin through patching.