CVE-2025-22752: GSheetConnector Forminator XSS Flaw

CVE-2025-22752 Overview

CVE-2025-22752 is a reflected Cross-Site Scripting (XSS) vulnerability in the WesternDeal GSheetConnector for Forminator Forms WordPress plugin. The flaw affects all versions up to and including 1.0.12 and stems from improper neutralization of user-supplied input during web page generation [CWE-79]. An unauthenticated attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the victim's browser session. The vulnerability is tracked under CVSS 3.1 with an attack vector of Network, low complexity, no privileges required, and user interaction required, resulting in a scope change.

Critical Impact
Successful exploitation allows attackers to execute arbitrary scripts in a victim's browser context, potentially leading to session theft, credential harvesting, or unauthorized administrative actions on the WordPress site.

Affected Products

GSheetConnector for Forminator Forms plugin versions through 1.0.12
WordPress sites running the gsheetconnector-forminator plugin
Any Forminator Forms deployment integrating the vulnerable connector

Discovery Timeline

2025-01-15 - CVE-2025-22752 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22752

Vulnerability Analysis

The plugin fails to sanitize or encode user-controlled input before reflecting it into an HTTP response. When a victim clicks a crafted link containing malicious JavaScript payloads in a vulnerable parameter, the browser renders the payload as executable code within the WordPress site's origin. Because the CVSS scope is changed, the injected script can affect resources beyond the vulnerable component, such as the browser's authenticated session for the WordPress administrative interface.

The EPSS probability is 0.329% with a percentile of 25.16, indicating limited observed exploitation attempts at this time. However, reflected XSS in WordPress plugins is a well-established attack surface for phishing and account takeover chains.

Root Cause

The root cause is missing output encoding on data flowing from HTTP request parameters into rendered HTML. The plugin does not apply WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() to reflected values, allowing script tags and event handlers to pass through unchanged.

Attack Vector

Exploitation requires the attacker to deliver a crafted URL to a target user, typically through phishing, forum posts, or social engineering. When the authenticated user loads the URL, the vulnerable endpoint reflects the payload into the response and the browser executes it. See the Patchstack WordPress Vulnerability Report for the full technical writeup.

No verified public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2025-22752

Indicators of Compromise

HTTP requests to plugin endpoints containing URL-encoded <script> tags, javascript: schemes, or event-handler attributes such as onerror= and onload=
Referer headers from external domains pointing to WordPress admin URLs with abnormal query parameters
Unexpected outbound requests from administrator browser sessions to attacker-controlled hosts

Detection Strategies

Inspect web server access logs for requests to gsheetconnector-forminator paths containing HTML metacharacters in query strings
Deploy Web Application Firewall (WAF) rules that flag reflected XSS payloads targeting WordPress plugin endpoints
Monitor browser session activity for anomalous script execution or DOM modifications originating from plugin pages

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized platform for correlation
Alert on repeated 4xx or 5xx responses from plugin URLs, which may indicate probing activity
Track administrator account activity for unusual API calls following clicks on external links

How to Mitigate CVE-2025-22752

Immediate Actions Required

Identify all WordPress instances running GSheetConnector for Forminator Forms version 1.0.12 or earlier
Restrict administrative access to the WordPress dashboard using IP allowlists or VPN gating until a patched version is deployed
Educate administrators about clicking untrusted links while authenticated to WordPress

Patch Information

At the time of writing, the vendor advisory published through Patchstack lists versions up to and including 1.0.12 as vulnerable. Site administrators should upgrade to the latest available release of gsheetconnector-forminator and monitor the Patchstack WordPress Vulnerability Report for the fixed version identifier.

Workarounds

Deactivate and remove the plugin if a patched version is not yet available
Deploy a WAF rule set that blocks reflected XSS payloads targeting WordPress plugin URLs
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce impact of reflected injection

bash

# Example nginx rule to block common reflected XSS patterns on the plugin path
location ~* /wp-content/plugins/gsheetconnector-forminator/ {
    if ($args ~* "(<|%3C)script") { return 403; }
    if ($args ~* "javascript:")   { return 403; }
    if ($args ~* "on[a-z]+=")     { return 403; }
}