CVE-2025-22343

WordPress wpSOL plugin <= 1.2.0 - CSRF to Stored XSS vulnerability

View on CVE.org
Published Jan 7, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Cross-Site Request Forgery (CSRF) vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through <= 1.2.0.

Analysis

AI-generated

Technical impact

A Cross‑Site Request Forgery flaw in the wpSOL WordPress plugin allows an attacker to submit a request that the plugin accepts and stores malicious script. The stored script is later displayed as part of the site’s content, creating a Stored XSS condition for users who view that content.

Affected Systems

WordPress sites using the wpSOL plugin from vendor koter84 with any version up to and including 1.2.0 are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a high potential for serious impact and the EPSS score is less than 1 %, showing a low probability of exploitation at present; the vulnerability is not listed in CISA KEV. The attack vector is a CSRF request; based on the description it is inferred that the plugin does not fully validate the origin of incoming requests, allowing the attacker’s crafted request to be accepted and the malicious content stored.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the wpSOL plugin to the latest available version from the official WordPress plugin repository.
  • If an upgrade cannot be applied immediately, limit access to the plugin’s administrative pages to users who possess the Administrator role and remove or sanitize any stored content that may contain script tags.
  • Add CSRF validation (e.g., a token or HTTP referer check) before accepting data submission requests into the plugin.
  • Ensure that any content rendered by the plugin is properly sanitized to strip or encode executable script elements.
  • Deploy a web application firewall rule set that blocks known XSS payloads when the wpSOL data submission endpoints are hit from untrusted origins.

Generated by OpenCVE AI on May 2, 2026 at 11:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-2742 Cross-Site Request Forgery (CSRF) vulnerability in Dennis Koot wpSOL allows Stored XSS.This issue affects wpSOL: from n/a through 1.2.0.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in Dennis Koot wpSOL allows Stored XSS.This issue affects wpSOL: from n/a through 1.2.0. Cross-Site Request Forgery (CSRF) vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through <= 1.2.0.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Cross-Site Request Forgery (CSRF) vulnerability in Dennis Koot wpSOL allows Stored XSS.This issue affects wpSOL: from n/a through 1.2.0.
Title WordPress wpSOL plugin <= 1.2.0 - CSRF to Stored XSS vulnerability
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
May 11, 2026, 10:35 PM
Reserved
Jan 3, 2025, 1:16 PM

View source JSON

Updated
Jan 7, 2025, 3:51 PM

JSON

Status
Deferred
Published
Jan 7, 2025, 11:15 AM
Modified
Jun 17, 2026, 8:46 AM

View source JSON

No data.

Updated
May 2, 2026, 12:00 PM

JSON