WordPress CloudFlare(R) Cache Purge Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) Schwachstelle

Successful exploitation of CVE-2025-22332 allows an attacker to inject arbitrary JavaScript code into web pages viewed by other users. This can be leveraged to steal session cookies, redirect users to malicious websites, or modify the content of the page. The impact is particularly severe in environments where the plugin is used to manage cached content, as an attacker could potentially inject malicious scripts into cached pages, affecting a wider range of users. The blast radius extends to any user accessing a page containing the injected script, potentially compromising their accounts and data.

WordPress websites utilizing the shanaver CloudFlare Cache Purge plugin, particularly those running older, unpatched versions (0.0.0–1.2), are at risk. Shared hosting environments where plugin updates are managed centrally may also be vulnerable if they haven't applied the patch.

• wordpress / composer / npm:

grep -r 'shanaver CloudFlare Cache Purge' /wp-content/plugins/
wp plugin list | grep 'cloudflare-cache-purge'

• generic web:

curl -I 'https://example.com/?param=<script>alert(1)</script>' | grep 'Content-Security-Policy'

1. 2025-01-31Disclosure

   disclosure

1. Reserviert2025-01-03
2. Veröffentlicht2025-01-31
3. Geändert2026-04-28
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-22332 is to immediately upgrade the CloudFlare Cache Purge plugin to version 1.2.1 or later. If upgrading is not immediately feasible, consider implementing input validation and output encoding on user-supplied data within the plugin. Web Application Firewalls (WAFs) can be configured to filter out potentially malicious requests containing XSS payloads. After upgrading, verify the fix by attempting to inject a simple JavaScript payload through the plugin's input fields and confirming that the script is not executed.