Cyber Posture

CVE-2025-26569

High

Published: 13 February 2025

Published
13 February 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0010 26.3th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user clicking a malicious link in order to gain execution.

Security Summary

CVE-2025-26569 is a Cross-Site Request Forgery (CSRF) vulnerability in the Post Thumbs WordPress plugin by callmeforsox, which enables Stored Cross-Site Scripting (XSS). The issue affects all versions of Post Thumbs from n/a through 1.5 inclusive. Published on 2025-02-13, it has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and is associated with CWE-352.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity, requiring only user interaction such as clicking a malicious link. By tricking a user into submitting a forged request—typically via a malicious webpage—the attacker can store an XSS payload on the target site. This leads to script execution in the context of other site users or administrators who view the affected content, with changed scope and low impacts to confidentiality, integrity, and availability.

The Patchstack advisory provides further details on this vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/post-thumbs/vulnerability/wordpress-post-thumbs-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-352

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Why these techniques?

CSRF to stored XSS in public-facing WordPress plugin exploitable via malicious link, directly enabling JavaScript execution in victim browsers.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References