CVE-2025-28905

CVE-2025-28905 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the Featured Posts Grid WordPress plugin by Chaser324. The issue affects all versions of the featured-posts-grid plugin up to and including 1.7. Published on 2025-03-11T21:15:47.780, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

An unauthenticated attacker can exploit this over the network with low attack complexity but requires user interaction. The vulnerability enables CSRF to Stored XSS, where an attacker tricks a victim—typically a site administrator—into submitting a malicious request that injects and persists an XSS payload on the site. When authenticated users or administrators view the affected page, the payload executes in their browser context, potentially compromising session data, performing actions on their behalf, or defacing content, resulting in low impacts to confidentiality, integrity, and availability with a changed scope.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/featured-posts-grid/vulnerability/wordpress-featured-posts-grid-plugin-1-7-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the CSRF-to-Stored XSS vulnerability in Featured Posts Grid version 1.7. Practitioners should review this reference for detailed technical analysis and recommended mitigations, such as plugin updates if available or input sanitization workarounds.