CVE-2025-26568
Published: 13 February 2025
Summary
CVE-2025-26568 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the specific CSRF to Stored XSS flaw in the Easy Amazon Product Information plugin versions <=4.0.1.
Enforces session authenticity mechanisms such as CSRF tokens to block forged requests that store malicious XSS payloads.
Validates and sanitizes plugin inputs to reject malicious XSS payloads before they are stored via the CSRF vector.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF to Stored XSS vulnerability in a public-facing WordPress plugin directly maps to T1190 (exploiting the vulnerable application endpoint) and enables T1185 (browser session hijacking via stored malicious script execution in victim browsers, as explicitly described in the impact for session hijacking and data theft).
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in jensmueller Easy Amazon Product Information easy-amazon-product-information allows Stored XSS.This issue affects Easy Amazon Product Information: from n/a through <= 4.0.1.
Deeper analysisAI
CVE-2025-26568 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin "Easy Amazon Product Information" by jensmueller, also referred to as easy-amazon-product-information, that allows Stored Cross-Site Scripting (XSS). This issue affects all versions of the plugin from n/a through 4.0.1 inclusive. The vulnerability is classified under CWE-352 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
The vulnerability can be exploited remotely by an unauthenticated attacker with network access and low complexity, though it requires user interaction from a victim, such as an authenticated WordPress user or administrator. In an attack scenario, the adversary tricks the victim into visiting a malicious webpage that submits a forged request to the vulnerable plugin endpoint, enabling the storage of a malicious XSS payload on the site. This Stored XSS can then execute in the context of other users' browsers, potentially leading to session hijacking, data theft, or further site compromise, with low impacts to confidentiality, integrity, and availability but changed scope.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/easy-amazon-product-information/vulnerability/wordpress-easy-amazon-product-information-plugin-4-0-1-csrf-to-stored-xss-vulnerability?_s_id=cve details this CSRF to Stored XSS vulnerability in the plugin version 4.0.1. Security practitioners should consult the advisory for guidance on verification, patching, and mitigation steps.
Details
- CWE(s)