CVE-2025-26569
Published: 13 February 2025
Summary
CVE-2025-26569 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly eliminates the CSRF-to-stored XSS vulnerability in the Post Thumbs plugin by applying patches or removing the affected component.
Information input validation rejects malicious XSS payloads submitted via forged CSRF requests, preventing their storage on the target site.
Information output filtering neutralizes stored XSS payloads, blocking script execution when affected content is viewed by users or administrators.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin exploitable via malicious link, directly enabling JavaScript execution in victim browsers.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in callmeforsox Post Thumbs post-thumbs allows Stored XSS.This issue affects Post Thumbs: from n/a through <= 1.5.
Deeper analysisAI
CVE-2025-26569 is a Cross-Site Request Forgery (CSRF) vulnerability in the Post Thumbs WordPress plugin by callmeforsox, which enables Stored Cross-Site Scripting (XSS). The issue affects all versions of Post Thumbs from n/a through 1.5 inclusive. Published on 2025-02-13, it has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and is associated with CWE-352.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity, requiring only user interaction such as clicking a malicious link. By tricking a user into submitting a forged request—typically via a malicious webpage—the attacker can store an XSS payload on the target site. This leads to script execution in the context of other site users or administrators who view the affected content, with changed scope and low impacts to confidentiality, integrity, and availability.
The Patchstack advisory provides further details on this vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/post-thumbs/vulnerability/wordpress-post-thumbs-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve.
Details
- CWE(s)