CVE-2025-22547

CVE-2025-22547 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, affecting the JK Html To Pdf WordPress plugin (jk-html-to-pdf) developed by jaykrishnang. The issue impacts all versions from n/a through 1.0.0, as published on 2025-01-07.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction needed, and changed scope with low impacts to confidentiality, integrity, and availability. Attackers without authentication can exploit it, potentially via CSRF leading to stored XSS as noted in advisories, injecting malicious scripts that persist and execute in the browsers of users interacting with affected pages or generated PDFs.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/jk-html-to-pdf/vulnerability/wordpress-jk-html-to-pdf-plugin-1-0-0-csrf-to-stored-xss-vulnerability?_s_id=cve) describes the CSRF-to-stored XSS vulnerability in the JK Html To Pdf plugin version 1.0.0, recommending mitigation through plugin updates or removal where patches are unavailable.