CVE-2025-22555

CVE-2025-22555 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Smoothness Slider Shortcode WordPress plugin by njshofe. This issue affects the plugin from unknown initial versions through v1.2.2. Published on 2025-01-07, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction needed, scope change, and low impacts across confidentiality, integrity, and availability.

Attackers without privileges can exploit this over the network by crafting malicious requests that trick authenticated users—likely administrators or editors—into unwittingly submitting them, such as via a forged link or form. User interaction is required for success. Exploitation enables low-level disruption to confidentiality, integrity, and availability, amplified by the scope change from the CSRF mechanism.

The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/smoothness-slider-shortcode/vulnerability/wordpress-smoothness-slider-shortcode-plugin-v1-2-2-csrf-to-stored-xss-vulnerability?_s_id=cve) characterizes this as a CSRF-to-Stored XSS vulnerability in Smoothness Slider Shortcode up to v1.2.2, recommending mitigation through plugin updates or removal where patches are unavailable.