CVE-2025-28897
Published: 11 March 2025
Summary
CVE-2025-28897 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-28897 is a Cross-Site Request Forgery (CSRF) vulnerability in the Steveorevo Domain Theme (domain-theme) WordPress plugin that allows Stored Cross-Site Scripting (XSS). The issue affects the plugin from unknown initial versions through 1.3 inclusive.
An unauthenticated attacker can exploit this vulnerability over the network with low attack complexity, requiring user interaction such as tricking a victim—typically an authenticated user like an administrator—into visiting a malicious site or clicking a crafted link. This submits a CSRF request to the plugin, enabling the injection of a stored XSS payload. Exploitation yields low impacts on confidentiality, integrity, and availability with a changed scope, per its CVSS score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), and is associated with CWE-352.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/domain-theme/vulnerability/wordpress-domain-theme-plugin-1-3-csrf-to-stored-xss-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations for affected WordPress installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7856
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Steveorevo Domain Theme domain-theme allows Stored XSS.This issue affects Domain Theme: from n/a through <= 1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin enables exploitation via CSRF to inject stored XSS payload, directly mapping to public-facing app exploitation and client-side JavaScript execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces session authenticity mechanisms such as CSRF tokens to prevent unauthorized cross-site requests that inject stored XSS payloads in the WordPress plugin.
Validates and sanitizes plugin inputs to block malicious XSS scripts from being stored even if a CSRF request succeeds.
Filters information outputs to prevent execution of any stored XSS payloads originating from the CSRF vulnerability.