CVE-2025-26569
Published: 13 February 2025
Summary
CVE-2025-26569 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-26569 is a Cross-Site Request Forgery (CSRF) vulnerability in the Post Thumbs WordPress plugin by callmeforsox, which enables Stored Cross-Site Scripting (XSS). The issue affects all versions of Post Thumbs from n/a through 1.5 inclusive. Published on 2025-02-13, it has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and is associated with CWE-352.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity, requiring only user interaction such as clicking a malicious link. By tricking a user into submitting a forged request—typically via a malicious webpage—the attacker can store an XSS payload on the target site. This leads to script execution in the context of other site users or administrators who view the affected content, with changed scope and low impacts to confidentiality, integrity, and availability.
The Patchstack advisory provides further details on this vulnerability, including mitigation recommendations, at https://patchstack.com/database/Wordpress/Plugin/post-thumbs/vulnerability/wordpress-post-thumbs-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4225
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF to stored XSS in public-facing WordPress plugin exploitable via malicious link, directly enabling JavaScript execution in victim browsers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces that state-changing requests include valid authorization context (e.g., anti-CSRF tokens), directly blocking the forged requests that trigger the stored XSS.
Requires validation and sanitization of all plugin inputs, preventing the malicious XSS payload from being stored and later executed.
Protects session authenticity so that requests lacking proper origin or token binding are rejected, mitigating the CSRF vector.