CVE-2025-26551
Published: 13 February 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-26551 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE-79, enabling Stored Cross-Site Scripting (XSS) in the sureshdsk Bootstrap Collapse WordPress plugin (bootstrap-collapse). This issue affects all versions from n/a through 1.0.4, as published on 2025-02-13 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity, though it requires user interaction. Exploitation changes the security scope, allowing limited impacts to confidentiality, integrity, and availability through execution of stored malicious scripts on pages viewed by other users.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/bootstrap-collapse/vulnerability/wordpress-bootstrap-collapse-plugin-1-0-4-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve details the issue as a CSRF-to-Stored XSS vulnerability in version 1.0.4; security practitioners should review it for recommended mitigations, such as plugin updates or input sanitization.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Stored XSS in public-facing WordPress plugin enables T1190 for initial exploitation and T1059.007 for malicious JavaScript execution in victim browsers.