CVE-2025-22342

CVE-2025-22342 is a Cross-Site Request Forgery (CSRF) vulnerability in the Jenst WP Simple Sitemap WordPress plugin (wp-simple-sitemap) that allows Stored XSS. This issue affects all versions from n/a through 0.2 inclusive. Published on 2025-01-07, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and is associated with CWE-352.

Attackers can exploit this vulnerability remotely with low complexity and no required privileges, though it demands user interaction such as an authenticated administrator visiting a malicious webpage. Exploitation enables CSRF to trigger Stored XSS, with changed scope leading to low-level impacts on confidentiality, integrity, and availability, potentially allowing payload injection visible to other users.

Patchstack advisories detail the vulnerability at https://patchstack.com/database/Wordpress/Plugin/wp-simple-sitemap/vulnerability/wordpress-wp-simple-sitemap-plugin-0-2-csrf-to-stored-xss-vulnerability?_s_id=cve, including guidance on mitigation.