CVE-2025-26550
Published: 13 February 2025
Summary
CVE-2025-26550 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-26550 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Global Meta Keyword & Description developed by Kunal Shivale. The flaw enables Stored Cross-Site Scripting (XSS) and affects all versions of the plugin up to and including 2.3. It carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network accessibility with low attack complexity, no required privileges, user interaction, and scope change resulting in low impacts to confidentiality, integrity, and availability.
Unauthenticated attackers (PR:N) can exploit this vulnerability by tricking authenticated WordPress users, such as administrators, into submitting malicious CSRF requests. Successful exploitation leads to Stored XSS, where malicious scripts are persistently injected and executed in the context of the site for subsequent visitors or admins, potentially enabling session hijacking, data theft, or further site compromise depending on the payload.
The primary advisory from Patchstack documents this CSRF-to-XSS issue specifically in plugin version 2.3 and is available at https://patchstack.com/database/Wordpress/Plugin/global-meta-keyword-and-description/vulnerability/wordpress-global-meta-keyword-description-plugin-2-3-csrf-to-cross-site-scripting-vulnerability?_s_id=cve. Security practitioners should consult this reference for detailed mitigation steps, which may include plugin updates if available or temporary workarounds like CSRF token enforcement.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4217
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Kunal Shivale Global Meta Keyword & Description global-meta-keyword-and-description allows Stored XSS.This issue affects Global Meta Keyword & Description: from n/a through <= 2.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin enables exploitation of the web application (T1190) and requires tricking users via malicious links to submit requests (T1204.001), leading to stored XSS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires session authenticity mechanisms like CSRF tokens to prevent unauthenticated attackers from tricking authenticated users into submitting malicious requests.
Enforces validation of plugin inputs to block malicious payloads from being stored via CSRF exploitation, directly addressing the Stored XSS outcome.
Filters information outputs to prevent execution of any stored malicious scripts injected through the CSRF vulnerability in subsequent user sessions.