CVE-2025-22752
Published: 15 January 2025
Summary
CVE-2025-22752 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gsheetconnector Gsheetconnector For Forminator Forms. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 35.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-22752 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WesternDeal GSheetConnector for Forminator Forms WordPress plugin (gsheetconnector-forminator). This issue affects all versions of the plugin from n/a through 1.0.12 inclusive. The vulnerability was published on 2025-01-15 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges required, though it necessitates user interaction such as clicking a malicious link. Upon successful exploitation, arbitrary scripts execute in the context of the victim's browser due to the changed scope (S:C), enabling low-level impacts on confidentiality, integrity, and availability—such as stealing session cookies, performing actions on behalf of the user, or modifying page content within the user's session.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gsheetconnector-forminator/vulnerability/wordpress-gsheetconnector-for-forminator-forms-plugin-1-0-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the Reflected XSS vulnerability in the GSheetConnector for Forminator Forms plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2967
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetconnector-forminator allows Reflected XSS.This issue affects GSheetConnector for Forminator Forms: from n/a through <= 1.0.12.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS allows arbitrary JavaScript execution in victim's browser (T1059.007) and directly facilitates stealing web session cookies (T1539) and browser session hijacking (T1185).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents reflected XSS by filtering malicious scripts from untrusted inputs reflected in dynamically generated web pages of the GSheetConnector WordPress plugin.
Validates and sanitizes user inputs to the plugin to block injection of executable scripts before they are processed or reflected.
Requires timely identification, prioritization, and patching of the specific improper neutralization flaw in GSheetConnector versions through 1.0.12.