CVE-2025-22628
Published: 27 March 2025
Summary
CVE-2025-22628 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22628 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the FolioVision Filled In WordPress plugin. The issue affects all versions of the plugin from unspecified initial releases through 1.9.2. Published on March 27, 2025, it carries a CVSS v3.1 base score of 7.1 (High), reflecting network accessibility, low attack complexity, no required privileges, user interaction dependency, changed scope, and low impacts on confidentiality, integrity, and availability.
An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) by leveraging a CSRF-to-Stored XSS vector, as detailed in the reference advisory. This requires tricking a user into performing an action (UI:R), such as submitting malicious input via a crafted request, which gets stored and executed in the context of the site for subsequent viewers (S:C). Successful exploitation enables script injection, potentially allowing theft of session data, site defacement, or further compromise for affected users.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/filled-in/vulnerability/wordpress-filled-in-plugin-1-9-1-csrf-to-stored-xss-vulnerability?_s_id=cve documents the CSRF-to-Stored XSS vulnerability specifically in Filled In plugin versions up to 1.9.1 and recommends mitigation through updating to a patched version beyond 1.9.2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14961
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision Filled In filled-in allows Stored XSS.This issue affects Filled In: from n/a through <= 1.9.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables T1190 (exploit public-facing app) and facilitates T1059.007 (arbitrary JavaScript execution for session theft/defacement).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper neutralization of input during web page generation, the root cause of this stored XSS vulnerability, by enforcing validation of all user-supplied inputs.
Prevents execution of stored malicious scripts in web pages by filtering and encoding information prior to output, mitigating the impact of injected XSS payloads.
Ensures timely remediation of the specific flaw in the Filled In WordPress plugin through software patching and vulnerability management.