Cyber Resilience

CVE-2025-28860

High

Published: 11 March 2025

Published
11 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0008 23.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28860 is a high-severity CSRF (CWE-352) vulnerability in Ppdpurveyor Google News Editors Picks Feed Generator. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-28860 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the WordPress plugin Google News Editors Picks Feed Generator (google-news-editors-picks-news-feeds). This flaw allows for Stored XSS and affects all versions of the plugin up to and including 2.1. The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges, and scope change.

A remote attacker can exploit this vulnerability without authentication by tricking a legitimate user, such as a site administrator, into interacting with a malicious webpage (UI:R). This CSRF action submits a crafted request that stores an XSS payload on the target site, enabling script execution in the context of other users viewing the affected content. Exploitation yields low impacts to confidentiality, integrity, and availability but leverages the changed scope (S:C) for broader effects within the site's trust boundaries.

The Patchstack advisory provides detailed analysis of the vulnerability, including reproduction steps and affected plugin versions; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/google-news-editors-picks-news-feeds/vulnerability/wordpress-google-news-editors-picks-feed-generator-plugin-2-1-csrf-to-stored-xss-vulnerability?_s_id=cve for mitigation guidance, such as updating to a patched version if available or disabling the plugin.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS.This issue affects Google News Editors Picks Feed Generator: from n/a through <= 2.1.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1204.001 Malicious Link Execution
An adversary may rely upon a user clicking a malicious link in order to gain execution.
Why these techniques?

The CSRF vulnerability in the public-facing WordPress plugin directly enables exploitation of the application (T1190). The attack requires tricking an authenticated user into interacting with a malicious webpage to trigger the CSRF and store the XSS payload (T1204.001).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-25121Shared CWE-352
CVE-2025-24001Shared CWE-352
CVE-2025-25147Shared CWE-352
CVE-2026-34904Shared CWE-352
CVE-2024-26153Shared CWE-352
CVE-2026-45430Shared CWE-352
CVE-2025-23880Shared CWE-352
CVE-2025-59541Shared CWE-352
CVE-2026-23622Shared CWE-352
CVE-2025-23445Shared CWE-352

Affected Assets

ppdpurveyor
google news editors picks feed generator
≤ 2.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

SI-2 mandates timely identification, reporting, and remediation of flaws like this CSRF-to-Stored XSS vulnerability in the WordPress plugin by patching or disabling it.

prevent

SC-23 requires session authenticity mechanisms such as anti-CSRF tokens to block forged requests that store XSS payloads without legitimate user intent.

prevent

SI-10 enforces input validation and sanitization to prevent malicious XSS payloads from being accepted and stored via the CSRF attack vector.

References