CVE-2025-22711

CVE-2025-22711 is an Improper Neutralization of Input During Web Page Generation vulnerability, enabling Reflected Cross-site Scripting (XSS), in the WordPress plugin Image Source Control (image-source-control-isc) by Thomas Maier. The issue affects all versions of the plugin from n/a through 2.29.0 and is classified under CWE-79.

With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability is exploitable over the network by unauthenticated attackers with low attack complexity, though it requires user interaction such as clicking a malicious link. Exploitation changes the scope and allows limited impacts on confidentiality, integrity, and availability, potentially enabling attackers to execute arbitrary scripts in the context of a victim's browser.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/image-source-control-isc/vulnerability/wordpress-image-source-control-lite-plugin-2-29-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve documents the Reflected XSS vulnerability in Image Source Control version 2.29.0 and provides details on mitigation, which includes updating the plugin beyond the affected versions.