CVE-2025-22548

CVE-2025-22548 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Stored Cross-site Scripting (XSS) as classified under CWE-79. It affects the ldap-login-password-and-role-manager WordPress plugin by frankkoenen, impacting all versions from n/a through 1.0.12.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction, with changed scope and low impacts on confidentiality, integrity, and availability. Unauthenticated attackers can exploit it via a CSRF-to-Stored XSS vector, tricking authenticated users into submitting malicious payloads that get stored and executed in the context of other users viewing affected pages.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ldap-login-password-and-role-manager/vulnerability/wordpress-ldap-login-password-and-role-manager-plugin-1-0-12-csrf-to-stored-xss-vulnerability?_s_id=cve details the vulnerability, including exploitation mechanics. Security practitioners should review it for specific patch availability and mitigation guidance.