CVE-2025-22748 Overview
CVE-2025-22748 is a stored Cross-Site Scripting (XSS) vulnerability in the Setmore SetMore Theme – Custom Post Types WordPress plugin (service-provider-profile-cpt). The flaw affects all plugin versions up to and including 1.1. The issue is tracked under [CWE-79] and stems from improper neutralization of user-supplied input during web page generation. An authenticated attacker with low privileges can inject malicious script payloads that persist in the plugin's output and execute in the browser of any user who views the affected page.
Critical Impact
A low-privileged authenticated user can store JavaScript that executes in other users' browsers, enabling session theft, account takeover, and unauthorized actions in the WordPress admin context.
Affected Products
- Setmore SetMore Theme – Custom Post Types plugin (service-provider-profile-cpt)
- All versions from unspecified initial release through 1.1
- WordPress installations using the affected plugin
Discovery Timeline
- 2025-01-15 - CVE-2025-22748 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22748
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Setmore custom post type plugin. Input submitted through plugin fields is not properly sanitized before storage. When the stored content is rendered back into a WordPress page, the browser interprets the injected markup as executable script. Because the payload persists in the database, every subsequent view of the affected page triggers execution.
The attack requires authentication with low privileges and user interaction to trigger execution. The scope change (S:C) reflects that injected script executes in a different security context than the injection point, typically the browser session of a higher-privileged administrator.
Root Cause
The root cause is missing or inadequate output escaping and input sanitization in the plugin's handling of custom post type fields. The plugin fails to apply WordPress core functions such as esc_html(), esc_attr(), or wp_kses_post() when rendering user-controlled data. Any HTML or JavaScript submitted through vulnerable input fields is stored verbatim and returned to viewers without neutralization.
Attack Vector
An attacker authenticated as a contributor-level or higher WordPress user submits a crafted payload through a vulnerable input field in the plugin's custom post type interface. The payload persists in the WordPress database. When an administrator or other user visits the page containing the injected content, the script executes with the victim's session privileges. Refer to the Patchstack XSS Vulnerability Advisory for technical details.
Detection Methods for CVE-2025-22748
Indicators of Compromise
- Unexpected <script>, <iframe>, or event handler attributes (onerror, onload) stored in wp_posts or plugin-specific tables
- Outbound HTTP requests from administrator browsers to unfamiliar domains following visits to plugin-managed pages
- New or modified WordPress administrator accounts created without corresponding legitimate activity
- Unauthorized changes to plugin settings or theme options after admin sessions
Detection Strategies
- Query the WordPress database for custom post type entries containing HTML tags or JavaScript event handlers in fields that should contain plain text
- Review web server access logs for POST requests to plugin endpoints from low-privileged user accounts
- Deploy a Web Application Firewall (WAF) rule set that inspects request bodies for XSS payload patterns targeting plugin routes
Monitoring Recommendations
- Enable WordPress audit logging to record post creation, updates, and user role changes tied to the affected plugin
- Monitor administrator session activity for anomalous API calls or configuration changes shortly after viewing plugin content
- Alert on the appearance of <script> tags or JavaScript URI schemes in plugin-managed content fields
How to Mitigate CVE-2025-22748
Immediate Actions Required
- Identify all WordPress instances running the service-provider-profile-cpt plugin at version 1.1 or earlier
- Restrict contributor and author role assignments until a patched version is deployed
- Audit existing custom post type content for injected script tags or suspicious HTML and remove any malicious entries
- Rotate administrator credentials and invalidate active sessions if compromise is suspected
Patch Information
At the time of publication, no fixed version is listed in the referenced advisory. Monitor the Patchstack XSS Vulnerability Advisory and the vendor's plugin repository for an updated release addressing versions beyond 1.1.
Workarounds
- Deactivate and remove the service-provider-profile-cpt plugin until a patched version is available
- Deploy a WAF rule that blocks HTML and JavaScript payloads in requests to the plugin's post submission endpoints
- Limit access to plugin editing capabilities to trusted administrators through role management plugins
- Apply a Content Security Policy (CSP) header that restricts inline script execution in the WordPress admin context
# Example CSP header to restrict inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.