CVE-2025-28905
Published: 11 March 2025
Summary
CVE-2025-28905 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-28905 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Stored Cross-site Scripting (XSS) under CWE-79, in the Featured Posts Grid WordPress plugin by Chaser324. The issue affects all versions of the featured-posts-grid plugin up to and including 1.7. Published on 2025-03-11T21:15:47.780, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).
An unauthenticated attacker can exploit this over the network with low attack complexity but requires user interaction. The vulnerability enables CSRF to Stored XSS, where an attacker tricks a victim—typically a site administrator—into submitting a malicious request that injects and persists an XSS payload on the site. When authenticated users or administrators view the affected page, the payload executes in their browser context, potentially compromising session data, performing actions on their behalf, or defacing content, resulting in low impacts to confidentiality, integrity, and availability with a changed scope.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/featured-posts-grid/vulnerability/wordpress-featured-posts-grid-plugin-1-7-csrf-to-stored-xss-vulnerability?_s_id=cve) documents the CSRF-to-Stored XSS vulnerability in Featured Posts Grid version 1.7. Practitioners should review this reference for detailed technical analysis and recommended mitigations, such as plugin updates if available or input sanitization workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7860
Vulnerability details
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaser324 Featured Posts Grid featured-posts-grid allows Stored XSS.This issue affects Featured Posts Grid: from n/a through <= 1.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation and sanitization of user inputs to prevent injection of malicious XSS payloads via CSRF-tricked submissions in the WordPress plugin.
Filters and encodes information prior to display on web pages, neutralizing stored XSS payloads when authenticated users view affected content.
Requires timely identification, reporting, and correction of flaws like this stored XSS vulnerability through plugin updates or removal.