CVE-2025-22325

CVE-2025-22325 is a Cross-Site Request Forgery (CSRF) vulnerability in the nchankov Autocompleter WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue affects Autocompleter versions from an unspecified initial release through 1.3.5.2 and is associated with CWE-352. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it requires user interaction. By tricking an authenticated user into performing a CSRF-protected action via a malicious webpage, an attacker can inject a stored XSS payload into the plugin, which executes in the context of the WordPress site for subsequent users.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/autocompleter/vulnerability/wordpress-autocompleter-plugin-1-3-5-2-csrf-to-stored-xss-vulnerability?_s_id=cve documents this CSRF to Stored XSS vulnerability in the Autocompleter plugin version 1.3.5.2.