CVE-2025-22590
Published: 07 January 2025
Summary
CVE-2025-22590 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-22590 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Prayer Times Anywhere (prayer-times-anywhere) by mmrs151 that allows Stored XSS. The issue affects versions from n/a through 2.0.1 and is associated with CWE-352. It received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low complexity, no privileges required, user interaction needed, and scope change with low impacts across confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely by tricking authenticated users into visiting a malicious webpage that submits a forged request, enabling the storage of XSS payloads. Once stored, these payloads execute in the context of other users viewing affected pages, potentially leading to session hijacking, data theft, or further site compromise within the plugin's scope.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/prayer-times-anywhere/vulnerability/wordpress-prayer-times-anywhere-plugin-2-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2865
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Prayer Times Anywhere prayer-times-anywhere allows Stored XSS.This issue affects Prayer Times Anywhere: from n/a through <= 2.0.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF-to-stored-XSS in public-facing WordPress plugin directly enables remote exploitation of a web application (T1190); user-interaction vector and session-hijacking impact are secondary and not core ATT&CK Enterprise techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Session Authenticity directly mitigates CSRF by requiring mechanisms such as anti-CSRF tokens to validate the legitimacy of state-changing requests exploited in this vulnerability.
Information Input Validation ensures malicious XSS payloads cannot be stored through forged CSRF requests by sanitizing and validating all inputs.
Information Output Filtering prevents execution of any stored XSS payloads by encoding or sanitizing outputs when pages are rendered for other users.