CVE-2025-22570

CVE-2025-22570 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the Inline Tweets WordPress plugin by mdjekic. The issue affects all versions of the plugin from n/a through 2.0 inclusive. Published on 2025-01-13, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability over the network with low attack complexity and no required privileges, though successful exploitation requires user interaction. By injecting malicious payloads through the plugin's input handling, adversaries can store scripts that execute in the browser context of authenticated or other users viewing affected pages, potentially leading to low impacts on confidentiality, integrity, and availability within a changed scope.

The Patchstack advisory provides further details on the vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/inline-tweets/vulnerability/wordpress-inline-tweets-plugin-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve.