Cyber Resilience

CVE-2025-28891

High

Published: 11 March 2025

Published
11 March 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS Score 0.0008 24.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28891 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-28891 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the jazzigor price-calc WordPress plugin that allows Stored XSS. The vulnerability affects price-calc versions from n/a through 0.6.3. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts across confidentiality, integrity, and availability.

The vulnerability can be exploited by unauthenticated attackers over the network who trick authenticated users, such as administrators, into performing unintended actions via a forged request. This leads to the storage of malicious XSS payloads, which can then execute in the context of other users viewing affected pages, potentially enabling session hijacking, data theft, or further site compromise.

The Patchstack advisory provides details on this CSRF-to-Stored XSS issue in the WordPress price-calc plugin version 0.6.3; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/price-calc/vulnerability/wordpress-price-calc-plugin-0-6-3-csrf-to-stored-xss-vulnerability?_s_id=cve for mitigation guidance and patch information.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in jazzigor price-calc price-calc allows Stored XSS.This issue affects price-calc: from n/a through <= 0.6.3.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
Why these techniques?

The vulnerability is in a public-facing WordPress plugin allowing network exploitation of CSRF to inject Stored XSS, directly mapping to T1190. The resulting XSS payload execution in user browsers facilitates stealing web session cookies (T1539) for the described session hijacking and data theft.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-23818Shared CWE-352
CVE-2025-22768Shared CWE-352
CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352
CVE-2025-22571Shared CWE-352
CVE-2024-53684Shared CWE-352

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates the CSRF vulnerability by enforcing session authenticity mechanisms like anti-CSRF tokens to prevent unauthenticated attackers from tricking authenticated users into storing malicious XSS payloads.

prevent

Validates information inputs to the price-calc plugin to block malicious XSS payloads from being stored via forged CSRF requests.

prevent

Addresses the specific flaw in price-calc versions through <=0.6.3 by identifying, testing, and installing patches as recommended in the Patchstack advisory.

References