CVE-2025-28860
Published: 11 March 2025
Summary
CVE-2025-28860 is a high-severity CSRF (CWE-352) vulnerability in Ppdpurveyor Google News Editors Picks Feed Generator. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-28860 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Google News Editors Picks Feed Generator (google-news-editors-picks-news-feeds). This flaw allows for Stored XSS and affects all versions of the plugin up to and including 2.1. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.
A remote attacker can exploit this vulnerability without authentication by tricking a legitimate user, such as a site administrator, into interacting with a malicious webpage (UI:R). This CSRF action submits a crafted request that stores an XSS payload on the target site, enabling script execution in the context of other users viewing the affected content. Exploitation yields low impacts to confidentiality, integrity, and availability but leverages the changed scope (S:C) for broader effects within the site's trust boundaries.
The Patchstack advisory provides detailed analysis of the vulnerability, including reproduction steps and affected plugin versions; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/google-news-editors-picks-news-feeds/vulnerability/wordpress-google-news-editors-picks-feed-generator-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve for mitigation guidance, such as updating to a patched version if available or disabling the plugin.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7830
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS.This issue affects Google News Editors Picks Feed Generator: from n/a through <= 2.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF vulnerability in the public-facing WordPress plugin directly enables exploitation of the application (T1190). The attack requires tricking an authenticated user into interacting with a malicious webpage to trigger the CSRF and store the XSS payload (T1204.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely identification, reporting, and remediation of flaws like this CSRF-to-Stored XSS vulnerability in the WordPress plugin by patching or disabling it.
SC-23 requires session authenticity mechanisms such as anti-CSRF tokens to block forged requests that store XSS payloads without legitimate user intent.
SI-10 enforces input validation and sanitization to prevent malicious XSS payloads from being accepted and stored via the CSRF attack vector.