CVE-2025-22752

CVE-2025-22752 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the WesternDeal GSheetConnector for Forminator Forms WordPress plugin (gsheetconnector-forminator). This issue affects all versions of the plugin from n/a through 1.0.12 inclusive. The vulnerability was published on 2025-01-15 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges required, though it necessitates user interaction such as clicking a malicious link. Upon successful exploitation, arbitrary scripts execute in the context of the victim's browser due to the changed scope (S:C), enabling low-level impacts on confidentiality, integrity, and availability—such as stealing session cookies, performing actions on behalf of the user, or modifying page content within the user's session.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/gsheetconnector-forminator/vulnerability/wordpress-gsheetconnector-for-forminator-forms-plugin-1-0-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve provides details on the Reflected XSS vulnerability in the GSheetConnector for Forminator Forms plugin.