CVE-2025-28891
Published: 11 March 2025
Summary
CVE-2025-28891 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-28891 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the jazzigor price-calc WordPress plugin that allows Stored XSS. The vulnerability affects price-calc versions from n/a through 0.6.3. It has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and changed scope with low impacts across confidentiality, integrity, and availability.
The vulnerability can be exploited by unauthenticated attackers over the network who trick authenticated users, such as administrators, into performing unintended actions via a forged request. This leads to the storage of malicious XSS payloads, which can then execute in the context of other users viewing affected pages, potentially enabling session hijacking, data theft, or further site compromise.
The Patchstack advisory provides details on this CSRF-to-Stored XSS issue in the WordPress price-calc plugin version 0.6.3; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/price-calc/vulnerability/wordpress-price-calc-plugin-0-6-3-csrf-to-stored-xss-vulnerability?_s_id=cve for mitigation guidance and patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7851
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in jazzigor price-calc price-calc allows Stored XSS.This issue affects price-calc: from n/a through <= 0.6.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is in a public-facing WordPress plugin allowing network exploitation of CSRF to inject Stored XSS, directly mapping to T1190. The resulting XSS payload execution in user browsers facilitates stealing web session cookies (T1539) for the described session hijacking and data theft.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CSRF vulnerability by enforcing session authenticity mechanisms like anti-CSRF tokens to prevent unauthenticated attackers from tricking authenticated users into storing malicious XSS payloads.
Validates information inputs to the price-calc plugin to block malicious XSS payloads from being stored via forged CSRF requests.
Addresses the specific flaw in price-calc versions through <=0.6.3 by identifying, testing, and installing patches as recommended in the Patchstack advisory.