CVE-2025-22513

CVE-2025-22513 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Simple Locator WordPress plugin developed by Kyle Phillips. This issue affects the simple-locator plugin from unknown initial versions through version 2.0.4 inclusive. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility and scope change.

Attackers can exploit this reflected XSS over the network with low complexity, requiring no authentication privileges but relying on user interaction, such as clicking a malicious link. Successful exploitation allows arbitrary script execution in the context of the victim's browser, potentially leading to low-level impacts on confidentiality (e.g., session token theft), integrity (e.g., data manipulation), and availability, amplified by the changed scope to affect other users or site functionality.

The primary advisory from Patchstack, available at https://patchstack.com/database/Wordpress/Plugin/simple-locator/vulnerability/wordpress-simple-locator-plugin-2-0-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, documents the reflected XSS vulnerability specifically in Simple Locator version 2.0.4 for WordPress. Security practitioners should review this reference for detailed mitigation steps, such as applying available plugin updates beyond version 2.0.4.