CVE-2025-22690
Published: 03 February 2025
Summary
CVE-2025-22690 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-23 requires mechanisms like anti-CSRF tokens to protect session authenticity, directly preventing the unauthenticated CSRF exploitation that stores XSS payloads.
SI-10 enforces input validation to reject malicious XSS payloads submitted via the CSRF vector before they are stored in the WordPress plugin.
SI-15 applies output filtering and encoding to neutralize any stored XSS payloads from executing in the victim's browser context.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is in a public-facing WordPress plugin allowing direct exploitation via T1190. The CSRF to stored XSS facilitates browser session hijacking (T1185) as described in the potential impacts like session hijacking.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects DigiTimber cPanel Integration: from n/a through <= 1.4.6.
Deeper analysisAI
CVE-2025-22690 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the DigiTimber cPanel Integration WordPress plugin (digitimber-cpanel-integration). This flaw allows for Stored XSS and affects all versions from n/a through 1.4.6. The vulnerability was published on 2025-02-03 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated attacker can exploit this over the network with low attack complexity by tricking a user, typically an authenticated administrator, into interacting with a malicious webpage (UI:R). This CSRF action enables the storage of an XSS payload, which executes in the victim's browser context with changed scope (S:C), potentially leading to low-level impacts on confidentiality, integrity, and availability, such as session hijacking or data theft from the affected site.
The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/digitimber-cpanel-integration/vulnerability/wordpress-digitimber-cpanel-integration-plugin-1-4-6-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)