Cyber Resilience

CVE-2025-26551

High

Published: 13 February 2025

Published
13 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0013 32.1th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26551 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2025-26551 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE-79, enabling Stored Cross-Site Scripting (XSS) in the sureshdsk Bootstrap Collapse WordPress plugin (bootstrap-collapse). This issue affects all versions from n/a through 1.0.4, as published on 2025-02-13 with a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Unauthenticated attackers can exploit this vulnerability remotely with low complexity, though it requires user interaction. Exploitation changes the security scope, allowing limited impacts to confidentiality, integrity, and availability through execution of stored malicious scripts on pages viewed by other users.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/bootstrap-collapse/vulnerability/wordpress-bootstrap-collapse-plugin-1-0-4-csrf-to-stored-cross-site-scripting-vulnerability?_s_id=cve details the issue as a CSRF-to-Stored XSS vulnerability in version 1.0.4; security practitioners should review it for recommended mitigations, such as plugin updates or input sanitization.

EU & UK References

Vulnerability details

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Bootstrap collapse bootstrap-collapse allows Stored XSS.This issue affects Bootstrap collapse: from n/a through <= 1.0.4.

CWE(s)
CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Stored XSS in public-facing WordPress plugin enables T1190 for initial exploitation and T1059.007 for malicious JavaScript execution in victim browsers.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-3231Shared CWE-79
CVE-2025-23481Shared CWE-79
CVE-2025-69302Shared CWE-79
CVE-2025-23734Shared CWE-79
CVE-2025-23571Shared CWE-79
CVE-2025-65110Shared CWE-79
CVE-2026-24948Shared CWE-79
CVE-2025-27352Shared CWE-79
CVE-2025-30349Shared CWE-79
CVE-2026-3876Shared CWE-79

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-15 Information Output Filtering good match
prevent

SI-15 requires filtering of information outputs during web page generation, directly preventing execution of stored malicious scripts from the XSS vulnerability.

SI-10 Information Input Validation good match
prevent

SI-10 enforces validation of inputs to the Bootstrap Collapse plugin, mitigating improper neutralization that enables stored XSS injection via CSRF.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates identification and remediation of flaws in vulnerable plugin versions up to 1.0.4, patching the root cause of the stored XSS issue.

References