CVE-2025-26562
Published: 13 February 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-26562 is a Cross-Site Request Forgery (CSRF) vulnerability in the Shambhu Patnaik RSS Filter (rss-filter) WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue affects all versions of the RSS Filter plugin from its initial release through version 1.2 inclusive. The vulnerability is associated with CWE-352 and has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges but relying on user interaction, such as tricking an authenticated WordPress user (e.g., an administrator) into performing a state-changing action via a malicious webpage. Upon success, the CSRF enables the storage of XSS payloads, which execute in the victim's browser context with changed scope, potentially leading to low impacts on confidentiality, integrity, and availability, such as session hijacking, data theft, or site defacement for subsequent visitors.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/rss-filter/vulnerability/wordpress-rss-filter-plugin-1-2-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the CSRF-to-Stored XSS vulnerability in RSS Filter plugin version 1.2 and provides details for security practitioners on detection and remediation.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CSRF-to-stored-XSS vulnerability in the public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and allows injection/execution of arbitrary JavaScript in victim browsers (T1059.007).