CVE-2025-28892
Published: 11 March 2025
Summary
CVE-2025-28892 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-28892 is a Cross-Site Request Forgery (CSRF) vulnerability in the a2rocklobster FTP Sync WordPress plugin (ftp-sync) that allows Stored XSS. This issue affects FTP Sync versions from n/a through 1.1.6 and is associated with CWE-352. The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it requires user interaction such as visiting a malicious site. Exploitation enables CSRF to inject and store XSS payloads, potentially leading to session hijacking, data theft, or further site compromise within the changed security scope.
Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/ftp-sync/vulnerability/wordpress-ftp-sync-plugin-1-1-6-csrf-to-stored-xss-vulnerability?_s_id=cve, provide details on the vulnerability in WordPress FTP Sync plugin version 1.1.6. Security practitioners should consult these references for patch availability and mitigation guidance, such as updating to a fixed version if available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7852
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in a2rocklobster FTP Sync ftp-sync allows Stored XSS.This issue affects FTP Sync: from n/a through <= 1.1.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a CSRF to stored XSS in a public-facing WordPress plugin, directly enabling remote exploitation of public-facing applications by unauthenticated attackers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of flaws like the CSRF-to-Stored XSS vulnerability in the FTP Sync WordPress plugin.
SC-23 enforces session authenticity mechanisms such as CSRF tokens to block unauthorized cross-site requests that inject XSS payloads via the FTP Sync plugin.
SI-10 validates information inputs to the FTP Sync plugin, preventing acceptance and storage of malicious XSS payloads delivered through CSRF exploitation.