CVE-2025-22513
Published: 27 January 2025
Summary
CVE-2025-22513 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22513 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Simple Locator WordPress plugin developed by Kyle Phillips. This issue affects the simple-locator plugin from unknown initial versions through version 2.0.4 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility and scope change.
Attackers can exploit this reflected XSS over the network with low complexity, requiring no authentication privileges but relying on user interaction, such as clicking a malicious link. Successful exploitation allows arbitrary script execution in the context of the victim's browser, potentially leading to low-level impacts on confidentiality (e.g., session token theft), integrity (e.g., data manipulation), and availability, amplified by the changed scope to affect other users or site functionality.
The primary advisory from Patchstack, available at https://patchstack.com/database/Wordpress/Plugin/simple-locator/vulnerability/wordpress-simple-locator-plugin-2-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, documents the reflected XSS vulnerability specifically in Simple Locator version 2.0.4 for WordPress. Security practitioners should review this reference for detailed mitigation steps, such as applying available plugin updates beyond version 2.0.4.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2793
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Simple Locator simple-locator allows Reflected XSS.This issue affects Simple Locator: from n/a through <= 2.0.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications via crafted malicious links requiring user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely identification, reporting, and correction of flaws such as the improper input neutralization in Simple Locator <=2.0.4, directly preventing reflected XSS exploitation via plugin updates.
SI-10 requires validation of user inputs before processing, directly countering the improper neutralization of input that enables reflected XSS in the plugin.
SI-15 enforces filtering and encoding of outputs during web page generation, comprehensively mitigating the reflected XSS by neutralizing malicious scripts before rendering.