Cyber Resilience

CVE-2025-26571

High

Published: 13 February 2025

Published
13 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0010 27.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26571 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-26571 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Wibiya Toolbar WordPress plugin. This issue affects all versions of the plugin from n/a through 2.0 inclusive. Published on 2025-02-13, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

The vulnerability can be exploited by unauthenticated attackers over the network with low attack complexity, requiring user interaction such as an administrator visiting a malicious webpage. Exploitation changes the scope and enables CSRF attacks that lead to stored XSS, allowing limited impacts to confidentiality, integrity, and availability.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wibiya/vulnerability/wordpress-wibiya-toolbar-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in wibiya Wibiya Toolbar wibiya allows Cross Site Request Forgery.This issue affects Wibiya Toolbar: from n/a through <= 2.0.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

CSRF vuln in public-facing WordPress plugin directly enables T1190 exploitation; leads to stored XSS facilitating JS code execution via T1059.007.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-28931Shared CWE-352
CVE-2025-23980Shared CWE-352
CVE-2025-23710Shared CWE-352
CVE-2025-23822Shared CWE-352
CVE-2025-25128Shared CWE-352
CVE-2025-31616Shared CWE-352
CVE-2025-23483Shared CWE-352
CVE-2025-23817Shared CWE-352
CVE-2025-23446Shared CWE-352
CVE-2025-23664Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

Directly mitigates CSRF by requiring mechanisms such as tokens to authenticate communication session legitimacy and prevent forged requests.

SI-10 Information Input Validation good match
prevent

Requires validation and sanitization of inputs from external sources, including verification of CSRF tokens to block malicious forged requests.

SI-2 Flaw Remediation good match
prevent

Ensures timely flaw remediation by patching or removing the vulnerable Wibiya Toolbar plugin to eliminate the CSRF-to-stored-XSS vulnerability.

References