CVE-2025-26545
Published: 13 February 2025
Description
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Security Summary
CVE-2025-26545 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Related Posts Line-up-Exactly by Milliard (related-posts-line-up-exactry-by-milliard) that allows Stored Cross-Site Scripting (XSS). The issue affects all versions of the plugin from n/a through 0.0.22 inclusive. It is associated with CWE-352 and has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network-based exploitation with low complexity, no privileges required, user interaction needed, changed scope, and low impacts across confidentiality, integrity, and availability.
An unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) by tricking an authenticated user, typically an administrator, into performing an unintended action via a malicious webpage or link (UI:R). This forged request injects and stores an XSS payload through the plugin's functionality, which executes in the browser context of subsequent users viewing affected pages, enabling potential theft of sensitive data like session cookies or further site compromise.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/related-posts-line-up-exactry-by-milliard/vulnerability/wordpress-related-posts-line-up-exactly-by-milliard-plugin-0-0-22-csrf-to-stored-xss-vulnerability?_s_id=cve provides details on this CSRF-to-Stored XSS vulnerability in the Related Posts Line-up-Exactly by Milliard plugin version 0.0.22. Security practitioners should consult this reference for specific mitigation recommendations, such as applying available patches or removing the vulnerable plugin.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a CSRF-to-stored-XSS vulnerability in a public-facing WordPress plugin, directly enabling T1190 (Exploit Public-Facing Application). The attack requires tricking an admin via a malicious link or webpage, facilitating T1566.002 (Spearphishing Link). The resulting stored XSS payload executes in victim browsers to steal session cookies, enabling T1185 (Browser Session Hijacking).