CVE-2025-22336
Published: 07 January 2025
Summary
CVE-2025-22336 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 requires mechanisms like anti-CSRF tokens to validate the authenticity of state-changing requests, directly preventing unauthenticated attackers from forging requests that store malicious XSS payloads.
SI-10 enforces validation and sanitization of user inputs to block malicious XSS scripts from being stored via the CSRF-vulnerable endpoint.
SI-15 applies output encoding and filtering to prevent execution of any stored XSS payloads when affected content is rendered for users.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-Stored XSS in public-facing WordPress plugin directly enables remote exploitation of a web application vulnerability (T1190).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in Amos Lee（一刀） Wizhi Multi Filters by Wenprise wizhi-multi-filters allows Stored XSS.This issue affects Wizhi Multi Filters by Wenprise: from n/a through <= 1.8.6.
Deeper analysisAI
CVE-2025-22336 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wizhi Multi Filters by Wenprise WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue affects all versions of the plugin from n/a through 1.8.6 inclusive and is associated with CWE-352. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its network accessibility, low complexity, lack of required privileges, user interaction requirement, and scope change with low impacts on confidentiality, integrity, and availability.
Unauthenticated attackers (PR:N) can exploit this vulnerability remotely (AV:N) by tricking authenticated users, such as site administrators, into interacting with a malicious request (UI:R), such as via a crafted link or form submission lacking proper CSRF tokens. Successful exploitation enables the storage of malicious XSS payloads on the site, which execute in the context of other users viewing affected content, potentially leading to session hijacking, data theft, or further site compromise.
The Patchstack advisory documents this CSRF-to-Stored XSS vulnerability specifically in the Wizhi Multi Filters by Wenprise WordPress plugin up to version 1.8.6, serving as a key reference for vulnerability details and collection within their database.
Details
- CWE(s)