Cyber Resilience

CVE-2025-22343

High

Published: 07 January 2025

Published
07 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0018 39.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22343 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-22343 is a Cross-Site Request Forgery (CSRF) vulnerability in the wpSOL WordPress plugin by koter84, which enables Stored XSS. The flaw affects wpSOL versions from n/a through 1.2.0 inclusive, as documented with CWE-352 and a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Unauthenticated attackers can exploit this vulnerability remotely with low complexity, requiring only user interaction such as visiting a malicious webpage. Exploitation leverages CSRF to trick authenticated users into submitting requests that store XSS payloads on the site, which then execute in the browsers of subsequent visitors, including administrators, with a changed scope and low impacts to confidentiality, integrity, and availability.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wpsol/vulnerability/wordpress-wpsol-plugin-1-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve) details the vulnerability in the wpSOL plugin up to version 1.2.0.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through <= 1.2.0.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
Why these techniques?

CSRF-to-Stored-XSS in public-facing WordPress plugin directly enables remote exploitation of web application (T1190) and is triggered via user visit to attacker-controlled page (T1189).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-23513Shared CWE-352
CVE-2025-25166Shared CWE-352
CVE-2025-22325Shared CWE-352
CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352
CVE-2025-22571Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

Enforces session authenticity mechanisms like CSRF tokens to prevent unauthenticated attackers from tricking authenticated users into storing XSS payloads via forged requests.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes plugin inputs to block malicious XSS payloads from being accepted and stored in the wpSOL WordPress plugin.

SI-15 Information Output Filtering good match
prevent

Filters information outputs to neutralize any stored XSS payloads before they execute in the browsers of site visitors including administrators.

References