CVE-2025-26562
Published: 13 February 2025
Summary
CVE-2025-26562 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-26562 is a Cross-Site Request Forgery (CSRF) vulnerability in the Shambhu Patnaik RSS Filter (rss-filter) WordPress plugin that allows Stored Cross-Site Scripting (XSS). This issue affects all versions of the RSS Filter plugin from its initial release through version 1.2 inclusive. The vulnerability is associated with CWE-352 and has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges but relying on user interaction, such as tricking an authenticated WordPress user (e.g., an administrator) into performing a state-changing action via a malicious webpage. Upon success, the CSRF enables the storage of XSS payloads, which execute in the victim's browser context with changed scope, potentially leading to low impacts on confidentiality, integrity, and availability, such as session hijacking, data theft, or site defacement for subsequent visitors.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/rss-filter/vulnerability/wordpress-rss-filter-plugin-1-2-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve) documents the CSRF-to-Stored XSS vulnerability in RSS Filter plugin version 1.2 and provides details for security practitioners on detection and remediation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4222
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Shambhu Patnaik RSS Filter rss-filter allows Stored XSS.This issue affects RSS Filter: from n/a through <= 1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF-to-stored-XSS vulnerability in the public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and allows injection/execution of arbitrary JavaScript in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of the specific CSRF-to-stored XSS flaw in the RSS Filter WordPress plugin, directly eliminating the vulnerability.
SC-23 enforces session authenticity mechanisms such as CSRF tokens, preventing attackers from tricking authenticated users into storing XSS payloads via forged requests.
SI-10 mandates validation of information inputs to the RSS filter, blocking malicious XSS payloads from being accepted and stored even if CSRF is attempted.