CVE-2025-22794

High

Published: 04 February 2025

Published

04 February 2025

Modified

28 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0013 32.1th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22794 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-22794 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the ianhaycox World Cup Predictor WordPress plugin (world-cup-predictor). The issue affects all versions from n/a through 1.9.8 and was published on 2025-02-04.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as visiting a malicious link. Remote attackers can exploit it by crafting inputs that are reflected unsanitized in web pages, executing arbitrary scripts in the browser of targeted users and achieving low impacts on confidentiality, integrity, and availability with a changed scope.

Patchstack's advisory at the referenced URL documents the Reflected XSS vulnerability in the World Cup Predictor plugin, providing details on the issue in version 1.9.6 and related versions up to 1.9.8. Security practitioners should consult this advisory for specific patch information and mitigation guidance, such as updating the plugin.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-2999

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows Reflected XSS.This issue affects World Cup Predictor: from n/a through <= 1.9.8.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Reflected XSS in public-facing WordPress plugin enables exploitation of public-facing applications via crafted inputs/links (T1190) and direct execution of arbitrary JavaScript in the browser (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1