CVE-2025-22559

CVE-2025-22559 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the TubePress.NET WordPress plugin (tubepressnet). This issue impacts all versions from n/a through 4.0.1, as published on 2025-01-07. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), highlighting its potential for network-based exploitation with low complexity and changed scope.

Attackers without privileges can exploit this CSRF flaw remotely by tricking authenticated users into interacting with malicious content, such as a crafted webpage. Successful exploitation requires user interaction but enables the attacker to force the victim's browser to submit unintended requests to the vulnerable plugin, potentially resulting in unauthorized actions with low impacts on confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tubepressnet/vulnerability/wordpress-tubepress-net-plugin-4-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve details this as a CSRF-to-stored XSS vulnerability in TubePress.NET version 4.0.1 for WordPress, providing further technical analysis for mitigation strategies.