CVE-2025-22555
Published: 07 January 2025
Summary
CVE-2025-22555 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-22555 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Smoothness Slider Shortcode WordPress plugin by njshofe. This issue affects the plugin from unknown initial versions through v1.2.2. Published on 2025-01-07, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction needed, scope change, and low impacts across confidentiality, integrity, and availability.
Attackers without privileges can exploit this over the network by crafting malicious requests that trick authenticated users—likely administrators or editors—into unwittingly submitting them, such as via a forged link or form. User interaction is required for success. Exploitation enables low-level disruption to confidentiality, integrity, and availability, amplified by the scope change from the CSRF mechanism.
The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/smoothness-slider-shortcode/vulnerability/wordpress-smoothness-slider-shortcode-plugin-v1-2-2-csrf-to-stored-xss-vulnerability?_s_id=cve) characterizes this as a CSRF-to-Stored XSS vulnerability in Smoothness Slider Shortcode up to v1.2.2, recommending mitigation through plugin updates or removal where patches are unavailable.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2833
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in njshofe Smoothness Slider Shortcode smoothness-slider-shortcode allows Cross Site Request Forgery.This issue affects Smoothness Slider Shortcode: from n/a through <= v1.2.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-Stored-XSS in a public-facing WordPress plugin directly enables remote exploitation of the application without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms to protect session authenticity, directly preventing CSRF attacks like CVE-2025-22555 by verifying that state-changing requests originate from legitimate user sessions.
SI-10 mandates validation of information inputs, including anti-CSRF tokens, to block forged requests that exploit the vulnerable Smoothness Slider Shortcode plugin.
SI-2 ensures timely flaw remediation through patching or removal of the affected plugin up to v1.2.2, eliminating the CSRF-to-Stored XSS vulnerability.