CVE-2025-22703

CVE-2025-22703 is a Cross-Site Request Forgery (CSRF) vulnerability in the manuelvicedo Forge – Front-End Page Builder WordPress plugin that allows Stored Cross-Site Scripting (XSS). The issue affects Forge – Front-End Page Builder versions from n/a through 1.4.6. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and maps to CWE-352.

The vulnerability can be exploited remotely over the network by unauthenticated attackers with low complexity, requiring user interaction such as visiting a malicious site. Exploitation involves tricking an authenticated user, likely an administrator, into performing a state-changing action via a forged request, resulting in the injection of persistent XSS payloads that execute in the context of other site visitors.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/forge/vulnerability/wordpress-forge-front-end-page-builder-plugin-1-4-6-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve details this CSRF-to-stored XSS issue in Forge version 1.4.6.