CVE-2025-22628

CVE-2025-22628 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the FolioVision Filled In WordPress plugin. The issue affects all versions of the plugin from unspecified initial releases through 1.9.2. Published on March 27, 2025, it carries a CVSS v3.1 base score of 7.1 (High), reflecting network accessibility, low attack complexity, no required privileges, user interaction dependency, changed scope, and low impacts on confidentiality, integrity, and availability.

An unauthenticated attacker (PR:N) can exploit this over the network (AV:N) by leveraging a CSRF-to-Stored XSS vector, as detailed in the reference advisory. This requires tricking a user into performing an action (UI:R), such as submitting malicious input via a crafted request, which gets stored and executed in the context of the site for subsequent viewers (S:C). Successful exploitation enables script injection, potentially allowing theft of session data, site defacement, or further compromise for affected users.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/filled-in/vulnerability/wordpress-filled-in-plugin-1-9-1-csrf-to-stored-xss-vulnerability?_s_id=cve documents the CSRF-to-Stored XSS vulnerability specifically in Filled In plugin versions up to 1.9.1 and recommends mitigation through updating to a patched version beyond 1.9.2.