CVE-2025-22322

CVE-2025-22322 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the DeluxeThemes Private Messages for UserPro plugin (userpro-messaging) for WordPress. The issue affects versions from n/a through 4.10.0 and was published on 2025-01-21.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Unauthenticated attackers can exploit it by injecting script payloads that reflect in the web page, achieving low impacts on confidentiality, integrity, and availability within the victim's browser context due to the changed scope.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/userpro-messaging/vulnerability/wordpress-private-messages-for-userpro-plugin-4-10-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.