CVE-2025-22331

CVE-2025-22331 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the P3JX Cf7Save Extension (cf7save-extension) WordPress plugin, impacting all versions from n/a through 1. The issue was published on 2025-01-09.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as clicking a malicious link. Remote attackers can exploit it by tricking authenticated or unauthenticated users into interacting with crafted input reflected in web pages, achieving limited impacts on confidentiality, integrity, and availability within a changed security scope, such as session token theft or malicious script execution in the victim's browser.

The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/cf7save-extension/vulnerability/wordpress-cf7save-extension-plugin-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.