CVE-2025-22593

CVE-2025-22593 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-Site Scripting (XSS) under CWE-79, affecting the Laika Pedigree Tree WordPress plugin (also referred to as burria Laika Pedigree Tree laika-pedigree-tree). The issue impacts all versions from n/a through 1.4 inclusive. It has a CVSS v3.1 base score of 7.1, reflecting network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), required user interaction (UI:R), changed scope (S:C), and low impacts on confidentiality, integrity, and availability (C:I:A:L/L/L).

Unauthenticated attackers can exploit this vulnerability over the network by leveraging a CSRF vector to inject malicious payloads into stored content within the plugin, as indicated by the advisory title referencing a CSRF-to-Stored XSS issue in version 1.4. Exploitation requires tricking a user into performing an action, such as submitting a form, which stores the XSS payload. When authenticated users or administrators view the affected pedigree tree pages, the payload executes in their browser context, potentially enabling theft of session cookies, session hijacking, or further phishing attacks within the site's scope.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/laika-pedigree-tree/vulnerability/wordpress-laika-pedigree-tree-plugin-1-4-csrf-to-stored-xss-vulnerability?_s_id=cve documents the vulnerability and provides details on the CSRF-to-Stored XSS flaw, including recommendations for mitigation such as updating to a patched version if available or applying input sanitization workarounds.