CVE-2025-26577
Published: 13 February 2025
Description
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Security Summary
CVE-2025-26577 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the daxiawp DX-auto-publish WordPress plugin (also referred to as dx-auto-publish). This flaw enables Stored XSS and affects all versions from n/a through 1.2 inclusive. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility, low attack complexity, no required privileges, user interaction dependency, changed scope, and low impacts across confidentiality, integrity, and availability.
An unauthenticated attacker can exploit this over the network by crafting a malicious webpage or resource that tricks an authenticated user into performing a state-changing action via CSRF, such as submitting a form that injects a Stored XSS payload. Upon successful exploitation, the attacker achieves Stored XSS execution in the context of the victim's browser, potentially leading to session hijacking, data theft, or further site compromise within the plugin's scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/dx-auto-publish/vulnerability/wordpress-dx-auto-publish-plugin-1-2-csrf-to-stored-xss-vulnerability?_s_id=cve documents this CSRF-to-Stored XSS issue specifically in DX-auto-publish version 1.2 for WordPress, providing details on the vulnerability for mitigation guidance.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability in public-facing WordPress plugin directly enables T1190 Exploit Public-Facing Application; resulting Stored XSS facilitates T1185 Browser Session Hijacking for session theft or further compromise.