CVE-2025-22685: Tags to Keywords CSRF Vulnerability

CVE-2025-22685 Overview

CVE-2025-22685 is a Cross-Site Request Forgery (CSRF) vulnerability in the CheGevara29 Tags to Keywords WordPress plugin (tags-to-meta-keywords). The flaw affects all versions up to and including 1.0.1. An attacker can chain the CSRF weakness to inject persistent JavaScript, producing a Stored Cross-Site Scripting (XSS) condition in the WordPress admin context. Successful exploitation requires an authenticated administrator to interact with an attacker-controlled link or page. The issue is tracked under CWE-352 and is documented in the Patchstack Vulnerability Report.

Critical Impact

An attacker who tricks an authenticated administrator into visiting a malicious page can persist JavaScript that executes for any user loading affected pages, enabling session theft and admin account takeover.

Affected Products

• CheGevara29 Tags to Keywords WordPress plugin (tags-to-meta-keywords)
• All versions from n/a through 1.0.1
• WordPress sites running the plugin with administrative users

Discovery Timeline

• 2025-02-03 - CVE-2025-22685 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-22685

Vulnerability Analysis

The Tags to Keywords plugin exposes plugin configuration endpoints without verifying the origin or authenticity of incoming requests. State-changing operations lack a valid WordPress nonce check (wp_verify_nonce / check_admin_referer), allowing forged requests to modify settings on behalf of an authenticated administrator.

Because the affected settings are rendered back into administrative pages without sufficient output encoding, the CSRF primitive escalates into Stored XSS. Injected payloads persist in the database and execute in the browser of any user viewing the affected admin or front-end content. The chained outcome impacts confidentiality, integrity, and availability at limited scope, with the cross-site scripting payload running in the victim's authenticated session.

Root Cause

The root cause is a missing CSRF token validation [CWE-352] on plugin request handlers that update configuration data. Combined with insufficient sanitization of the resulting stored values, an attacker-controlled payload reaches the DOM unescaped. The vulnerability exists in all versions up to and including 1.0.1.

Attack Vector

Exploitation requires user interaction. An attacker hosts a crafted HTML page or email containing an auto-submitting form that targets the vulnerable plugin endpoint. When an authenticated WordPress administrator loads the attacker page, the browser submits the forged request with valid session cookies. The plugin accepts the request and persists attacker-controlled script content. The payload subsequently executes when the victim or other users render the affected admin view.

The vulnerability is described in prose only; no verified public proof-of-concept code is referenced in the advisory data. See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-22685

Indicators of Compromise

• Unexpected <script> tags, onerror=, or javascript: URIs stored in plugin configuration rows within the wp_options table
• WordPress administrator accounts created or modified shortly after a settings update from the Tags to Keywords plugin
• Outbound requests from administrator browsers to unfamiliar domains immediately after loading affected admin pages

Detection Strategies

• Inspect plugin option values for HTML or JavaScript content that should not appear in keyword or tag fields
• Review web server access logs for POST requests to plugin admin endpoints lacking a _wpnonce parameter or with a Referer header pointing to external domains
• Hunt for anomalous admin sessions originating from administrators visiting external links, then performing settings changes seconds later

Monitoring Recommendations

• Enable WordPress audit logging to capture option updates and content changes performed by administrative users
• Monitor wp-admin traffic for cross-origin form submissions and missing nonce parameters
• Alert on JavaScript execution patterns in admin sessions, including unexpected XHR calls to user creation or role assignment endpoints

How to Mitigate CVE-2025-22685

Immediate Actions Required

• Deactivate and remove the Tags to Keywords plugin (tags-to-meta-keywords) until a patched release is published
• Audit plugin settings and post metadata for injected script content and remove any malicious entries
• Force password resets and session invalidation for all WordPress administrator accounts that may have visited untrusted sites while authenticated

Patch Information

At the time of the latest NVD update, no fixed version is identified beyond 1.0.1, which remains vulnerable. Monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release that adds nonce verification and output encoding.

Workarounds

• Replace the plugin with a maintained alternative that handles tag-to-keyword conversion with proper CSRF protections
• Restrict access to /wp-admin/ by IP allowlist or VPN to reduce the attack surface for CSRF delivery
• Deploy a Web Application Firewall rule that blocks state-changing requests to plugin endpoints when the Referer is absent or off-domain
• Enforce a strict Content Security Policy on wp-admin pages to limit inline script execution from injected payloads

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate tags-to-meta-keywords
wp plugin delete tags-to-meta-keywords

# Audit options table for suspicious script content
wp db query "SELECT option_name, option_value FROM wp_options \
  WHERE option_value LIKE '%<script%' \
     OR option_value LIKE '%onerror=%' \
     OR option_value LIKE '%javascript:%';"