CVE-2025-22358
Published: 07 January 2025
Summary
CVE-2025-22358 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22358 is an improper neutralization of input during web page generation vulnerability, classified as reflected cross-site scripting (XSS) under CWE-79, in the WP Advertising Management WordPress plugin developed by Simone Marcon. The issue affects all versions of the plugin from n/a through 1.0.3 inclusive. Published on 2025-01-07, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, and scope change despite requiring user interaction.
Remote attackers require no privileges and can exploit the vulnerability over the network with low complexity by tricking authenticated users into interacting with malicious content, such as clicking a crafted link or submitting tainted input that reflects executable scripts. Successful exploitation enables script injection into dynamically generated web pages viewed in the victim's browser, potentially compromising low levels of confidentiality (e.g., session data exposure), integrity (e.g., data tampering), and availability (e.g., denial of service), with impacts extending beyond the vulnerable component due to the changed scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/advertising-management/vulnerability/wordpress-wp-advertising-management-plugin-1-0-3-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2756
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simone Marcon Wp advertising management advertising-management allows Reflected XSS.This issue affects Wp advertising management: from n/a through <= 1.0.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of web application (T1190) and arbitrary JavaScript execution in victim browser (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Filters information outputs during web page generation to neutralize malicious scripts and prevent reflected XSS exploitation in the WP Advertising Management plugin.
Validates user inputs to the plugin before processing, blocking tainted inputs that could lead to improper neutralization and script injection.
Remediates the specific flaw in WP Advertising Management versions through 1.0.3 by identifying, prioritizing, and applying patches to eliminate the XSS vulnerability.