Cyber Resilience

CVE-2025-22538

High

Published: 07 January 2025

Published
07 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0010 28.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22538 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-22538 is a Cross-Site Request Forgery (CSRF) vulnerability in the Virtual Bot WordPress plugin developed by Ofek Nakar that enables Stored Cross-Site Scripting (XSS). The flaw, associated with CWE-352, affects all versions of the virtual-bot plugin up to and including 1.0.0. It received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its network accessibility, low complexity, lack of required privileges, user interaction dependency, and changed scope with low impacts on confidentiality, integrity, and availability. The vulnerability was published on 2025-01-07.

An unauthenticated attacker can exploit this CSRF issue remotely by crafting a malicious webpage or link that, when visited by an authenticated WordPress user with sufficient privileges, triggers a forged request to store XSS payloads in the plugin. This allows the attacker to achieve stored XSS execution in the context of the victim's browser, potentially leading to session hijacking, data exfiltration, or further site compromise within the plugin's scope.

Mitigation details are documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/virtual-bot/vulnerability/wordpress-virtual-bot-plugin-1-0-0-csrf-cross-site-scripting-xss-vulnerability?_s_id=cve, which covers the CSRF to Stored XSS vulnerability in Virtual Bot plugin version 1.0.0.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Stored XSS.This issue affects Virtual Bot: from n/a through <= 1.0.0.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF-to-stored-XSS flaw in public-facing WordPress plugin directly enables remote exploitation of a web application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352
CVE-2025-22571Shared CWE-352
CVE-2024-53684Shared CWE-352
CVE-2025-23455Shared CWE-352
CVE-2025-22582Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

Enforces session authenticity mechanisms like anti-CSRF tokens to prevent unauthenticated attackers from forging requests that store XSS payloads in the Virtual Bot plugin.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes plugin inputs to block malicious XSS payloads from being accepted and stored via the CSRF vulnerability.

SI-15 Information Output Filtering good match
prevent

Filters outputs displaying stored data from the plugin to neutralize XSS payloads before execution in victims' browsers.

References