CVE-2025-22336: Wizhi Multi Filters CSRF Vulnerability

CVE-2025-22336 Overview

CVE-2025-22336 is a Cross-Site Request Forgery (CSRF) vulnerability in the Wizhi Multi Filters by Wenprise WordPress plugin that enables Stored Cross-Site Scripting (XSS) attacks. This chained vulnerability allows attackers to trick authenticated administrators into unknowingly submitting malicious requests that inject persistent JavaScript code into the plugin's settings or filter configurations.

Critical Impact

Attackers can leverage this CSRF-to-XSS chain to execute arbitrary JavaScript in the context of any user viewing affected pages, potentially leading to session hijacking, administrative account takeover, or further malware distribution to site visitors.

Affected Products

• Wizhi Multi Filters by Wenprise plugin versions up to and including 1.8.6
• WordPress installations using vulnerable versions of the wizhi-multi-filters plugin

Discovery Timeline

• 2025-01-07 - CVE-2025-22336 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22336

Vulnerability Analysis

This vulnerability represents a chained attack combining two distinct web application security weaknesses. The plugin fails to implement proper CSRF protection (CWE-352) on administrative form submissions, allowing an attacker to craft malicious web pages that automatically submit requests on behalf of authenticated administrators. The lack of input sanitization in the affected form fields then allows the injected content to persist as Stored XSS, executing whenever the compromised page is subsequently viewed.

The network-based attack vector requires user interaction, specifically tricking an authenticated administrator into visiting a malicious page while logged into their WordPress dashboard. Once successful, the stored XSS payload persists in the database, affecting all subsequent visitors to pages rendering the compromised filter settings.

Root Cause

The root cause of CVE-2025-22336 lies in the absence of CSRF token validation on administrative form handlers within the Wizhi Multi Filters plugin. WordPress provides built-in nonce verification functions such as wp_verify_nonce() and check_admin_referer() that should be implemented to validate the origin of form submissions. The plugin's failure to utilize these protections, combined with inadequate output encoding when rendering user-supplied data, creates the conditions for this chained attack.

Attack Vector

The attack is executed over the network and requires the following conditions:

1. An attacker crafts a malicious HTML page containing an auto-submitting form that targets the vulnerable plugin endpoint
2. The form includes JavaScript payload in fields that will be stored by the plugin
3. An authenticated WordPress administrator with plugin management privileges visits the attacker's page
4. The victim's browser automatically submits the form to their WordPress installation
5. The malicious script is stored in the database and executes when filter pages are rendered

The vulnerability exploits the trust relationship between the browser and the WordPress admin session. Since the request appears to originate from an authenticated session, WordPress processes it as legitimate. The stored XSS payload then affects all users who view the compromised content.

Detection Methods for CVE-2025-22336

Indicators of Compromise

• Unexpected JavaScript code or <script> tags appearing in Wizhi Multi Filters plugin settings
• Unfamiliar or obfuscated content in filter configuration fields in the wp_options table
• Browser developer console showing unexpected script execution on pages with multi-filter functionality
• User reports of strange redirects or popup behavior on filtered product/content pages

Detection Strategies

• Review plugin settings for any JavaScript or HTML that was not intentionally configured
• Audit WordPress database for suspicious entries related to wizhi-multi-filters options
• Monitor web application firewall (WAF) logs for POST requests to plugin admin handlers from unusual referrer URLs
• Implement Content Security Policy (CSP) headers to detect and block inline script execution

Monitoring Recommendations

• Enable WordPress audit logging to track administrative changes to plugin settings
• Configure alerts for modifications to plugin options outside of normal administrative workflows
• Deploy endpoint detection solutions to monitor for suspicious browser behavior indicating XSS exploitation
• Review access logs for requests to plugin endpoints with suspicious referrer headers indicating CSRF attempts

How to Mitigate CVE-2025-22336

Immediate Actions Required

• Update the Wizhi Multi Filters by Wenprise plugin to a patched version when available from the vendor
• Review current plugin settings for any unauthorized or suspicious content and remove any injected scripts
• Audit WordPress user sessions and reset credentials for any potentially compromised administrator accounts
• Temporarily disable the plugin if a patch is not yet available and the functionality is not critical

Patch Information

According to the Patchstack WordPress Vulnerability Report, this vulnerability affects Wizhi Multi Filters by Wenprise versions through 1.8.6. Site administrators should monitor the WordPress plugin repository for an updated version that addresses this vulnerability and apply the patch immediately upon release.

Workarounds

• Implement a Web Application Firewall (WAF) rule to enforce referrer validation on plugin admin endpoints
• Restrict access to WordPress admin panel to trusted IP addresses only
• Educate administrators about phishing and social engineering attacks that could lead to CSRF exploitation
• Consider using a WordPress security plugin that provides CSRF protection and XSS filtering as an additional defense layer