CVE-2025-22805 Overview
CVE-2025-22805 is a stored cross-site scripting (XSS) vulnerability in the Themepoints Skill Bar WordPress plugin. The flaw affects all versions of the skillbars plugin up to and including version 1.2. Attackers with contributor-level or higher privileges can inject malicious JavaScript payloads that persist in the database and execute in the browsers of site visitors and administrators. The vulnerability is categorized under [CWE-79], improper neutralization of input during web page generation.
Critical Impact
Authenticated attackers can inject persistent JavaScript that executes against site administrators, enabling session theft, privilege escalation, and further compromise of the WordPress installation.
Affected Products
- Themepoints Skill Bar (skillbars) WordPress plugin versions up to and including 1.2
- WordPress installations with the vulnerable plugin activated
- Sites allowing contributor or higher role registration
Discovery Timeline
- 2025-01-09 - CVE-2025-22805 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22805
Vulnerability Analysis
The Skill Bar plugin fails to sanitize user-supplied input before storing it in the WordPress database and rendering it back to the page. Authenticated users with permission to create or edit skill bar entries can inject arbitrary HTML and JavaScript through plugin-controlled input fields. The malicious payload persists across page loads and executes whenever any user renders content containing the affected skill bar shortcode or widget.
Because the scope changes (S:C in the CVSS vector), the injected script runs in the security context of the WordPress admin interface when triggered by an authenticated administrator. This enables cross-privilege impact from a lower-privileged account. The EPSS score is 0.214% at the 11.965 percentile as of 2026-09-22.
Root Cause
The plugin does not apply WordPress sanitization functions such as wp_kses_post(), sanitize_text_field(), or esc_html() to input received from plugin forms. Output is emitted without contextual escaping such as esc_attr() or esc_html(), allowing browser-parseable script tags and event handlers to reach the DOM intact.
Attack Vector
An attacker with contributor-level or higher access creates or edits a skill bar containing a JavaScript payload in a vulnerable field. The payload is written to the database. When an administrator, editor, or site visitor loads a page rendering that skill bar, the browser executes the injected script. User interaction is required to trigger the payload, consistent with the UI:R attribute of the vulnerability.
See the Patchstack Security Vulnerability Report for technical details.
Detection Methods for CVE-2025-22805
Indicators of Compromise
- Skill bar entries or plugin option rows containing <script> tags, javascript: URIs, or DOM event attributes such as onerror, onload, or onclick
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading pages that render skill bars
- New WordPress administrator accounts or role changes following interaction with plugin-rendered content
- Modifications to wp_posts or wp_options referencing the skillbars plugin from low-privileged accounts
Detection Strategies
- Query the WordPress database for plugin content containing script tags or JavaScript event handlers
- Monitor web server logs for POST requests to admin-ajax.php and plugin edit endpoints originating from contributor accounts
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations tied to plugin pages
- Review WordPress audit logs for skill bar creation or modification events by non-administrator users
Monitoring Recommendations
- Enable a WordPress audit logging plugin to capture content changes with user attribution
- Alert on administrator sessions performing anomalous actions immediately after viewing content pages containing skill bars
- Track file integrity of the wp-content/plugins/skillbars/ directory for unauthorized modification
- Instrument browser telemetry from admin workstations to flag JavaScript execution from unexpected origins
How to Mitigate CVE-2025-22805
Immediate Actions Required
- Deactivate and remove the Themepoints Skill Bar plugin until a patched release is confirmed available
- Audit user roles and remove or downgrade untrusted contributor and author accounts
- Rotate credentials and session tokens for all administrator accounts that may have loaded affected pages
- Inspect all existing skill bar entries for malicious payloads and remove any injected script content
Patch Information
As of the last NVD update on 2026-06-17, no fixed version beyond 1.2 is referenced in the advisory. Monitor the Patchstack advisory and the plugin's WordPress.org page for a security release. Until a patched version is published, uninstall the plugin.
Workarounds
- Restrict plugin editing capabilities to trusted administrators only using role management controls
- Deploy a Web Application Firewall (WAF) rule to block requests containing <script> or JavaScript event handlers targeting plugin endpoints
- Enforce a strict Content Security Policy that disallows inline scripts on pages rendering plugin output
- Disable the shortcode and widget until the plugin is removed or patched
# Remove the vulnerable plugin via WP-CLI
wp plugin deactivate skillbars
wp plugin uninstall skillbars
# Audit database for injected script payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%<script%' OR post_content LIKE '%onerror=%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
