CVE-2025-22794

CVE-2025-22794 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the ianhaycox World Cup Predictor WordPress plugin (world-cup-predictor). The issue affects all versions from n/a through 1.9.8 and was published on 2025-02-04.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, and user interaction such as visiting a malicious link. Remote attackers can exploit it by crafting inputs that are reflected unsanitized in web pages, executing arbitrary scripts in the browser of targeted users and achieving low impacts on confidentiality, integrity, and availability with a changed scope.

Patchstack's advisory at the referenced URL documents the Reflected XSS vulnerability in the World Cup Predictor plugin, providing details on the issue in version 1.9.6 and related versions up to 1.9.8. Security practitioners should consult this advisory for specific patch information and mitigation guidance, such as updating the plugin.