CVE-2025-22651: Stylish Google Sheet Reader XSS Flaw

CVE-2025-22651 Overview

CVE-2025-22651 is a reflected cross-site scripting (XSS) vulnerability in the Stylish Google Sheet Reader WordPress plugin developed by wppluginboxdev. The flaw affects all versions of the plugin up to and including version 4.0. The plugin fails to neutralize user-supplied input during web page generation, allowing attackers to inject malicious script content that executes in the victim's browser. The vulnerability is classified under CWE-79 and requires user interaction to exploit, typically through a crafted link.

Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in the context of a victim's authenticated WordPress session, potentially leading to session hijacking, credential theft, or unauthorized administrative actions.

Affected Products

Stylish Google Sheet Reader plugin (stylish-google-sheet-reader) for WordPress
All versions from initial release through 4.0
WordPress installations with this plugin active

Discovery Timeline

2025-04-17 - CVE-2025-22651 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22651

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-controlled input during HTML response generation. The Stylish Google Sheet Reader plugin reflects request parameters back into rendered pages without applying appropriate output encoding or input sanitization. Attackers can craft URLs containing JavaScript payloads that execute when a victim follows the malicious link.

The scope change indicated by the CVSS vector means the injected script can affect resources beyond the vulnerable component's security boundary. This includes accessing browser cookies, session tokens, and the broader WordPress administrative context. The EPSS probability sits at 0.622%, placing it in the 70th percentile for exploitation likelihood.

Root Cause

The root cause is the absence of context-aware output encoding when the plugin echoes request parameters into the HTML response. Standard WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() were not applied to user-controlled values before rendering. This omission permits browsers to interpret injected <script> tags or event handler attributes as executable code.

Attack Vector

Exploitation requires an attacker to deliver a crafted URL to a target user, typically through phishing, social engineering, or malicious link placement. When the victim clicks the link and the vulnerable plugin processes the request, the injected payload executes in the victim's browser. No authentication is required from the attacker, but user interaction is necessary for the attack to succeed.

The vulnerability mechanism involves attacker-controlled query parameters being reflected directly into the response body. See the Patchstack Vulnerability Report for technical details on the affected parameters.

Detection Methods for CVE-2025-22651

Indicators of Compromise

HTTP requests containing URL-encoded <script> tags, javascript: URIs, or common XSS payload patterns targeting plugin endpoints
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after clicking external links
WordPress audit logs showing unauthorized configuration changes performed by privileged users without corresponding admin console activity

Detection Strategies

Monitor web server access logs for requests to stylish-google-sheet-reader plugin paths containing suspicious query string content such as onerror=, onload=, or encoded script tags
Deploy web application firewall (WAF) rules to identify reflected XSS payload signatures in inbound HTTP traffic
Inspect referer headers on WordPress admin requests for unexpected external origins that may indicate clickjacking or social engineering delivery

Monitoring Recommendations

Enable WordPress security plugin logging to track plugin parameter values and administrator session activity
Forward web server and WordPress audit logs to a centralized SIEM for correlation with phishing telemetry
Set alerts for anomalous administrator behavior such as new user creation or plugin installation from unexpected source IPs

How to Mitigate CVE-2025-22651

Immediate Actions Required

Deactivate and remove the Stylish Google Sheet Reader plugin if a patched version is not yet available
Invalidate all active WordPress administrator sessions and require password resets for privileged accounts
Review WordPress audit logs for unauthorized changes occurring after April 17, 2025

Patch Information

At the time of NVD publication, the vendor advisory listed by Patchstack indicates the vulnerability affects versions through 4.0 with no fixed version specified. Administrators should consult the Patchstack Vulnerability Report for current patch status and upgrade guidance.

Workarounds

Remove the plugin from production WordPress installations until a vendor patch is confirmed available
Deploy a WAF rule blocking requests to plugin endpoints that contain HTML or JavaScript metacharacters in query parameters
Apply Content Security Policy (CSP) headers restricting inline script execution to limit the impact of reflected payloads
Train administrators to avoid clicking unsolicited links targeting their WordPress sites

bash

# Example nginx configuration to block common XSS patterns on plugin paths
location ~* /wp-content/plugins/stylish-google-sheet-reader/ {
    if ($args ~* "(<|%3C)script|javascript:|onerror=|onload=") {
        return 403;
    }
}

# Example Content Security Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";