CVE-2025-22582

CVE-2025-22582 is a Cross-Site Request Forgery (CSRF) vulnerability in the Uptime Robot WordPress plugin developed by Scott Nelle, which allows Stored XSS. The issue affects Uptime Robot versions from n/a through <= 0.1.3 and is associated with CWE-352. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges but relying on user interaction. A malicious actor could trick a user, such as a site administrator, into performing an action via a forged request from a malicious site, leading to the storage of an XSS payload. Successful exploitation results in low impacts to confidentiality, integrity, and availability, with a changed scope.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/uptime-robot/vulnerability/wordpress-uptime-robot-plugin-0-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve.