CVE-2025-22332
Published: 31 January 2025
Summary
CVE-2025-22332 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates reflected XSS by filtering malicious inputs from web page outputs generated by the vulnerable CloudFlare Cache Purge plugin.
Ensures validation of attacker-controlled inputs to the plugin, preventing improper neutralization that enables XSS exploitation.
Requires timely identification and remediation of the specific XSS flaw in CloudFlare Cache Purge versions up to 1.2, eliminating the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables arbitrary client-side script execution in the victim's browser via crafted URLs, directly facilitating browser session hijacking (T1185) and exploitation through user interaction with malicious links (T1204.001).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanaver CloudFlare(R) Cache Purge cloudflare-cache-purge allows Reflected XSS.This issue affects CloudFlare(R) Cache Purge: from n/a through <= 1.2.
Deeper analysisAI
CVE-2025-22332 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the shanaver CloudFlare(R) Cache Purge WordPress plugin (cloudflare-cache-purge), impacting versions from n/a through 1.2 inclusive. The issue was published on 2025-01-31.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Remote attackers require no privileges and can exploit it over the network with low attack complexity, though it demands user interaction such as clicking a malicious link. Exploitation reflects attacker-controlled input in web page generation, potentially allowing limited impacts on confidentiality, integrity, and availability with a changed scope, such as session hijacking or client-side script execution in the victim's browser.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/cloudflare-cache-purge/vulnerability/wordpress-cloudflare-r-cache-purge-plugin-1-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which covers the Reflected XSS in the WordPress CloudFlare(R) Cache Purge plugin version 1.2.
Details
- CWE(s)