CVE-2025-22325: Autocompleter CSRF Vulnerability

CVE-2025-22325 Overview

CVE-2025-22325 is a Cross-Site Request Forgery (CSRF) vulnerability in the nchankov Autocompleter WordPress plugin that enables attackers to execute Stored Cross-Site Scripting (XSS) attacks. This chained vulnerability allows malicious actors to trick authenticated administrators into unknowingly submitting malicious requests that inject persistent JavaScript code into the WordPress site.

Critical Impact

Successful exploitation allows attackers to chain CSRF with Stored XSS, enabling persistent malicious script injection that executes in the context of any user visiting the affected pages. This can lead to session hijacking, credential theft, and complete site compromise.

Affected Products

• WordPress Autocompleter plugin versions 1.3.5.2 and earlier
• WordPress sites running vulnerable Autocompleter plugin versions

Discovery Timeline

• 2025-01-07 - CVE-2025-22325 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22325

Vulnerability Analysis

This vulnerability combines two distinct attack techniques: Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS). The Autocompleter plugin fails to properly validate request origins through nonce verification or other CSRF protection mechanisms when processing administrative actions. This absence of protection allows an attacker to craft malicious requests that, when submitted by an authenticated administrator, inject JavaScript payloads that are stored persistently in the database.

The stored XSS component means the malicious script persists across page loads and user sessions, affecting all visitors to pages where the injected content is rendered. The attack requires social engineering to lure an administrator into clicking a malicious link or visiting an attacker-controlled page while authenticated to WordPress.

Root Cause

The root cause of CVE-2025-22325 lies in insufficient security controls within the Autocompleter plugin's form handling mechanism. The plugin does not implement WordPress nonce verification (wp_verify_nonce()) for state-changing operations, and it fails to sanitize or escape user-supplied input before storing it in the database and rendering it on the page. This dual failure creates the conditions necessary for the CSRF-to-Stored-XSS attack chain.

Attack Vector

The attack is network-based and requires user interaction. An attacker must craft a malicious HTML page or link containing a forged request targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator with sufficient privileges visits the attacker's page or clicks the malicious link, the forged request is automatically submitted with the administrator's session credentials. The payload delivered through this request is then stored in the WordPress database and executed whenever any user views the affected content.

The vulnerability exploits the trust relationship between the browser and the WordPress site, bypassing same-origin protections through social engineering rather than technical exploits.

Detection Methods for CVE-2025-22325

Indicators of Compromise

• Unexpected or unfamiliar JavaScript code in plugin settings or database entries associated with Autocompleter
• Suspicious <script> tags or event handlers (onclick, onerror, etc.) in stored content
• Unusual administrator activity logs showing configuration changes without corresponding legitimate sessions
• Reports from users of unexpected browser behavior or redirects when visiting the WordPress site

Detection Strategies

• Review WordPress database tables for malicious JavaScript payloads in fields associated with the Autocompleter plugin
• Monitor web server access logs for suspicious POST requests to Autocompleter plugin endpoints from external referrers
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Use WordPress security plugins to scan for known XSS patterns in stored content

Monitoring Recommendations

• Enable WordPress audit logging to track administrative configuration changes
• Configure web application firewall (WAF) rules to detect CSRF attack patterns and XSS payloads
• Implement browser-based XSS auditing through security headers
• Regularly scan the WordPress installation using security assessment tools

How to Mitigate CVE-2025-22325

Immediate Actions Required

• Disable or deactivate the Autocompleter plugin immediately if version 1.3.5.2 or earlier is installed
• Audit the WordPress database for any stored XSS payloads that may have been injected
• Review administrator activity logs for unauthorized configuration changes
• Force logout all authenticated sessions and require password resets for administrative accounts
• Consider implementing a Web Application Firewall (WAF) to block malicious requests

Patch Information

No official patch information is available at this time. Monitor the Patchstack WordPress Plugin Advisory for updates regarding patched versions. Site administrators should check for plugin updates regularly and apply security patches as soon as they become available.

Workarounds

• Disable the Autocompleter plugin until a patched version is released
• Implement server-level CSRF protection using .htaccess rules to validate the Referer header for POST requests
• Add Content Security Policy headers to prevent inline script execution: Content-Security-Policy: script-src 'self'
• Restrict administrative access to trusted IP addresses only
• Use a Web Application Firewall with XSS and CSRF protection rules enabled

# Example .htaccess configuration to add basic referrer checking
# Place in WordPress root directory

<IfModule mod_rewrite.c>
RewriteEngine On
# Block POST requests with empty or external referrers to wp-admin
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} /wp-admin/
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteRule .* - [F,L]
</IfModule>

# Add Content Security Policy header
<IfModule mod_headers.c>
Header set Content-Security-Policy "script-src 'self'; object-src 'none';"
</IfModule>