CVE-2025-22538

CVE-2025-22538 is a Cross-Site Request Forgery (CSRF) vulnerability in the Virtual Bot WordPress plugin developed by Ofek Nakar that enables Stored Cross-Site Scripting (XSS). The flaw, associated with CWE-352, affects all versions of the virtual-bot plugin up to and including 1.0.0. It received a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its network accessibility, low complexity, lack of required privileges, user interaction dependency, and changed scope with low impacts on confidentiality, integrity, and availability. The vulnerability was published on 2025-01-07.

An unauthenticated attacker can exploit this CSRF issue remotely by crafting a malicious webpage or link that, when visited by an authenticated WordPress user with sufficient privileges, triggers a forged request to store XSS payloads in the plugin. This allows the attacker to achieve stored XSS execution in the context of the victim's browser, potentially leading to session hijacking, data exfiltration, or further site compromise within the plugin's scope.

Mitigation details are documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/virtual-bot/vulnerability/wordpress-virtual-bot-plugin-1-0-0-csrf-cross-site-scripting-xss-vulnerability?_s_id=cve, which covers the CSRF to Stored XSS vulnerability in Virtual Bot plugin version 1.0.0.