CVE-2025-22593
Published: 07 January 2025
Summary
CVE-2025-22593 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22593 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-Site Scripting (XSS) under CWE-79, affecting the Laika Pedigree Tree WordPress plugin (also referred to as burria Laika Pedigree Tree laika-pedigree-tree). The issue impacts all versions from n/a through 1.4 inclusive. It has a CVSS v3.1 base score of 7.1, reflecting network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), required user interaction (UI:R), changed scope (S:C), and low impacts on confidentiality, integrity, and availability (C:I:A:L/L/L).
Unauthenticated attackers can exploit this vulnerability over the network by leveraging a CSRF vector to inject malicious payloads into stored content within the plugin, as indicated by the advisory title referencing a CSRF-to-Stored XSS issue in version 1.4. Exploitation requires tricking a user into performing an action, such as submitting a form, which stores the XSS payload. When authenticated users or administrators view the affected pedigree tree pages, the payload executes in their browser context, potentially enabling theft of session cookies, session hijacking, or further phishing attacks within the site's scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/laika-pedigree-tree/vulnerability/wordpress-laika-pedigree-tree-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve documents the vulnerability and provides details on the CSRF-to-Stored XSS flaw, including recommendations for mitigation such as updating to a patched version if available or applying input sanitization workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2868
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burria Laika Pedigree Tree laika-pedigree-tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through <= 1.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables exploitation of public-facing apps (T1190) and facilitates browser session hijacking via injected scripts (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of information inputs to neutralize malicious payloads like XSS scripts injected via CSRF in the Laika Pedigree Tree plugin.
SI-15 mandates filtering of information outputs to prevent execution of stored XSS payloads when users view affected pedigree tree pages.
SI-2 ensures timely flaw remediation, such as patching the vulnerable Laika Pedigree Tree plugin versions <=1.4 or applying input sanitization.