CVE-2025-22521

CVE-2025-22521 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS) as classified under CWE-79. It affects the WordPress plugin "wp Hosting Performance Check" by Scott Farrell, with all versions from n/a through 2.18.8 vulnerable. The issue was published on 2025-01-09 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Remote attackers with no required privileges can exploit this vulnerability over the network with low attack complexity, though it requires user interaction such as visiting a maliciously crafted link or page. Exploitation changes scope and results in low impacts to confidentiality, integrity, and availability, allowing injected scripts to execute in the context of the victim's browser.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-hosting-performance-check/vulnerability/wordpress-wp-hosting-performance-check-plugin-2-18-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the Reflected XSS issue in wp-hosting-performance-check plugin version 2.18.8, serving as the primary reference for mitigation guidance.