CVE-2025-28860

CVE-2025-28860 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Google News Editors Picks Feed Generator (google-news-editors-picks-news-feeds). This flaw allows for Stored XSS and affects all versions of the plugin up to and including 2.1. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.

A remote attacker can exploit this vulnerability without authentication by tricking a legitimate user, such as a site administrator, into interacting with a malicious webpage (UI:R). This CSRF action submits a crafted request that stores an XSS payload on the target site, enabling script execution in the context of other users viewing the affected content. Exploitation yields low impacts to confidentiality, integrity, and availability but leverages the changed scope (S:C) for broader effects within the site's trust boundaries.

The Patchstack advisory provides detailed analysis of the vulnerability, including reproduction steps and affected plugin versions; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/google-news-editors-picks-news-feeds/vulnerability/wordpress-google-news-editors-picks-feed-generator-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve for mitigation guidance, such as updating to a patched version if available or disabling the plugin.