Cyber Resilience

CVE-2025-22814

High

Published: 09 January 2025

Published
09 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0018 40.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22814 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-22814 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Zephyr Modern Admin Theme (zephyr-modern-admin-theme) WordPress plugin developed by Dylan James. The issue affects all versions of the plugin up to and including 1.4.1, enabling attackers to perform unauthorized actions on behalf of authenticated users.

With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability can be exploited remotely by unauthenticated attackers with low complexity. Exploitation requires user interaction, typically tricking an authenticated administrator into visiting a malicious webpage or clicking a forged link, which submits unauthorized requests and results in low impacts to confidentiality, integrity, and availability, with a changed scope.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/zephyr-modern-admin-theme/vulnerability/wordpress-zephyr-admin-theme-plugin-1-4-1-csrf-to-stored-xss-vulnerability?_s_id=cve) describes this as a CSRF-to-stored XSS vulnerability in version 1.4.1 and provides details on mitigation, which security practitioners should consult for patching or workaround guidance.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF-to-stored-XSS in a public-facing WordPress plugin directly enables remote exploitation of a web application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352
CVE-2025-22571Shared CWE-352
CVE-2024-53684Shared CWE-352
CVE-2025-23455Shared CWE-352
CVE-2025-22582Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 mandates session authenticity mechanisms such as anti-CSRF tokens, directly preventing forged requests that exploit this CSRF vulnerability in the WordPress plugin.

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely identification, reporting, and correction of system flaws, directly addressing the need to patch the vulnerable Zephyr Admin Theme plugin up to version 1.4.1.

SI-10 Information Input Validation partial match
prevent

SI-10 enforces validation of information inputs, mitigating the stored XSS payload that results from successful CSRF exploitation in this vulnerability.

References