Cyber Resilience

CVE-2025-22690

High

Published: 03 February 2025

Published
03 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0003 9.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22690 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-22690 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the DigiTimber cPanel Integration WordPress plugin (digitimber-cpanel-integration). This flaw allows for Stored XSS and affects all versions from n/a through 1.4.6. The vulnerability was published on 2025-02-03 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

An unauthenticated attacker can exploit this over the network with low attack complexity by tricking a user, typically an authenticated administrator, into interacting with a malicious webpage (UI:R). This CSRF action enables the storage of an XSS payload, which executes in the victim's browser context with changed scope (S:C), potentially leading to low-level impacts on confidentiality, integrity, and availability, such as session hijacking or data theft from the affected site.

The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/digitimber-cpanel-integration/vulnerability/wordpress-digitimber-cpanel-integration-plugin-1-4-6-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in DigiTimber DigiTimber cPanel Integration digitimber-cpanel-integration allows Stored XSS.This issue affects DigiTimber cPanel Integration: from n/a through <= 1.4.6.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
Why these techniques?

The vulnerability is in a public-facing WordPress plugin allowing direct exploitation via T1190. The CSRF to stored XSS facilitates browser session hijacking (T1185) as described in the potential impacts like session hijacking.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-23900Shared CWE-352
CVE-2026-29784Shared CWE-352
CVE-2025-25140Shared CWE-352
CVE-2025-23567Shared CWE-352
CVE-2025-31443Shared CWE-352
CVE-2025-31444Shared CWE-352
CVE-2025-26577Shared CWE-352
CVE-2025-30587Shared CWE-352
CVE-2025-23501Shared CWE-352
CVE-2025-23426Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 requires mechanisms like anti-CSRF tokens to protect session authenticity, directly preventing the unauthenticated CSRF exploitation that stores XSS payloads.

SI-10 Information Input Validation good match
prevent

SI-10 enforces input validation to reject malicious XSS payloads submitted via the CSRF vector before they are stored in the WordPress plugin.

SI-15 Information Output Filtering good match
prevent

SI-15 applies output filtering and encoding to neutralize any stored XSS payloads from executing in the victim's browser context.

References