CVE-2025-26759
Published: 16 February 2025
Summary
CVE-2025-26759 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and patching of the specific CSRF-to-stored XSS flaw in Content Snippet Manager plugin versions <=1.1.5.
Enforces session authenticity mechanisms like anti-CSRF tokens to block unauthenticated attackers from tricking users into injecting malicious snippet payloads.
Validates inputs to snippet management functions, preventing malicious XSS payloads from being stored even if a CSRF request bypasses session checks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vuln in public-facing WordPress plugin directly enables T1190 exploitation; stored XSS facilitates T1185 via session hijacking and data theft in browser context.
NVD Description
Cross-Site Request Forgery (CSRF) vulnerability in alexvtn Content Snippet Manager content-snippet-manager allows Stored XSS.This issue affects Content Snippet Manager: from n/a through <= 1.1.5.
Deeper analysisAI
CVE-2025-26759 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the alexvtn Content Snippet Manager WordPress plugin (content-snippet-manager). It affects all versions from n/a through 1.1.5 and enables Stored XSS execution. The issue has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility and scope change.
Unauthenticated attackers (PR:N) can exploit this over the network (AV:N) with low complexity (AC:L), provided they induce user interaction (UI:R), such as tricking an authenticated WordPress user—likely an administrator or editor with snippet management privileges—into visiting a malicious site or clicking a forged link. This triggers a CSRF request that injects malicious payloads, resulting in stored XSS. The stored script executes in the context of the WordPress site for subsequent visitors, achieving low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) with changed scope (S:C), potentially leading to session hijacking, data theft, or further site compromise.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/content-snippet-manager/vulnerability/wordpress-content-snippet-manager-plugin-1-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve details the CSRF-to-Stored XSS vulnerability in version 1.1.5 and recommends updating to a patched version beyond 1.1.5 as the primary mitigation.
Details
- CWE(s)