CVE-2025-22360
Published: 28 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-22360 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the promact WP Azure Offload plugin (wp-azure-offload) for WordPress. The flaw affects all versions from n/a through 2.0 inclusive, as published on 2025-03-28.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, and user interaction needed. Unauthenticated attackers can exploit it by delivering malicious payloads via reflected inputs, tricking site users into actions like visiting a crafted URL, leading to script execution in the victim's browser context with changed scope and low impacts on confidentiality, integrity, and availability.
The Patchstack advisory provides further details on this WordPress plugin vulnerability at https://patchstack.com/database/Wordpress/Plugin/wp-azure-offload/vulnerability/wordpress-wp-azure-offload-plugin-2-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Reflected XSS in public-facing WordPress plugin directly enables exploitation of public-facing applications via crafted URLs leading to browser script execution.