CVE-2025-22573 Overview
CVE-2025-22573 is a stored cross-site scripting (XSS) vulnerability in the copist Icons Enricher WordPress plugin. The flaw affects all versions of the icons-enricher plugin up to and including 1.0.8. Authenticated attackers with low privileges can inject malicious scripts that persist in the database and execute in the browsers of other users who view the affected pages. The vulnerability is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.
Critical Impact
Attackers can inject persistent JavaScript that executes when administrators or site visitors load pages rendered by the plugin, enabling session hijacking, credential theft, or unauthorized administrative actions.
Affected Products
- copist Icons Enricher WordPress plugin (icons-enricher)
- All versions from initial release through 1.0.8
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-01-07 - CVE-2025-22573 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22573
Vulnerability Analysis
The Icons Enricher plugin fails to properly neutralize user-supplied input before storing it and rendering it back within generated web pages. An authenticated user with contributor-level or comparable privileges can submit crafted input containing HTML or JavaScript payloads. The plugin stores this input without sufficient sanitization or output encoding.
When a subsequent user loads a page that renders the tainted content, the browser executes the injected script in the site's origin. Because the scope is marked as changed in the vulnerability metadata, the injected payload can affect components beyond the vulnerable plugin, including administrator sessions. User interaction is required, meaning a victim must load or view the affected page for exploitation to succeed.
Root Cause
The root cause is missing or insufficient input sanitization and output escaping within the plugin's request handlers and template rendering paths. WordPress provides functions such as sanitize_text_field(), wp_kses(), and esc_html() for these purposes, but the affected plugin code does not consistently apply them to fields that accept icon labels, URLs, or associated metadata. Payloads persist in the WordPress database and re-enter the DOM whenever the affected view is rendered.
Attack Vector
Exploitation follows the standard stored XSS pattern for WordPress plugins. An authenticated low-privileged user submits a payload containing script tags, event handlers, or JavaScript URI schemes through a plugin input field. The payload is written to the database. When an administrator or visitor accesses a page that displays this content, the script executes with the privileges of the viewing user. See the Patchstack WordPress Vulnerability Report for additional advisory context.
Detection Methods for CVE-2025-22573
Indicators of Compromise
- Unexpected <script> tags, on* event handler attributes, or javascript: URIs stored in WordPress post metadata or plugin option rows related to icons-enricher.
- Outbound HTTP requests from administrator browsers to unfamiliar third-party domains shortly after loading pages rendered by the plugin.
- New or modified WordPress administrator accounts created without a corresponding legitimate admin action in the audit log.
Detection Strategies
- Query the WordPress database for plugin-managed fields containing HTML control characters and script-related keywords.
- Inspect rendered HTML from pages using the Icons Enricher plugin for unescaped angle brackets, quotes, or JavaScript event attributes.
- Correlate low-privilege user submissions with subsequent administrator session anomalies such as unexpected privilege changes or plugin installations.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture script-source violations originating from WordPress admin pages.
- Log and alert on administrative actions performed within short intervals of low-privilege user content submissions.
- Monitor web server access logs for POST requests to plugin endpoints containing encoded script payloads.
How to Mitigate CVE-2025-22573
Immediate Actions Required
- Deactivate the Icons Enricher plugin on all WordPress sites running version 1.0.8 or earlier until a fixed release is verified.
- Audit user roles and remove unnecessary contributor, author, or editor accounts that could be used to submit malicious content.
- Review recent submissions handled by the plugin and remove any entries containing script tags or event handlers.
Patch Information
No fixed version is documented in the referenced advisory at the time of publication. Administrators should consult the Patchstack advisory and the plugin's official WordPress.org page for updated release information before reactivating the plugin.
Workarounds
- Restrict access to plugin functionality by limiting who can create or edit content that flows into Icons Enricher fields.
- Deploy a web application firewall (WAF) rule to block requests containing common XSS payload patterns targeting the plugin's endpoints.
- Enforce a strict Content Security Policy that disallows inline script execution on WordPress admin and content pages.
# Disable the vulnerable plugin using WP-CLI until a patch is available
wp plugin deactivate icons-enricher
wp plugin status icons-enricher
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
