CVE-2025-22342
Published: 07 January 2025
Summary
CVE-2025-22342 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-22342 is a Cross-Site Request Forgery (CSRF) vulnerability in the Jenst WP Simple Sitemap WordPress plugin (wp-simple-sitemap) that allows Stored XSS. This issue affects all versions from n/a through 0.2 inclusive. Published on 2025-01-07, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and is associated with CWE-352.
Attackers can exploit this vulnerability remotely with low complexity and no required privileges, though it demands user interaction such as an authenticated administrator visiting a malicious webpage. Exploitation enables CSRF to trigger Stored XSS, with changed scope leading to low-level impacts on confidentiality, integrity, and availability, potentially allowing payload injection visible to other users.
Patchstack advisories detail the vulnerability at https://patchstack.com/database/Wordpress/Plugin/wp-simple-sitemap/vulnerability/wordpress-wp-simple-sitemap-plugin-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve, including guidance on mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2741
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Jenst WP Simple Sitemap wp-simple-sitemap allows Stored XSS.This issue affects WP Simple Sitemap: from n/a through <= 0.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-Stored-XSS in public-facing WordPress plugin directly enables remote exploitation of a web application for initial access and payload injection.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific CSRF to Stored XSS flaw in the WP Simple Sitemap plugin through timely patching as advised by vendor guidance.
Enforces session authenticity mechanisms like anti-CSRF tokens to prevent unauthorized state-changing requests that store XSS payloads via tricked administrator actions.
Validates inputs to plugin endpoints to block malicious XSS payloads from being accepted and stored during CSRF exploitation.