CVE-2025-28932
Published: 11 March 2025
Summary
CVE-2025-28932 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-28932 is a Cross-Site Request Forgery (CSRF) vulnerability in the BCS Website Solutions Insert Code WordPress plugin (insert-code) that allows Stored Cross-Site Scripting (XSS). Published on 2025-03-11, the issue affects versions from n/a through <=2.4 and is associated with CWE-352.
Attackers with network access can exploit this vulnerability without privileges (PR:N), though it requires user interaction (UI:R) and has low attack complexity (AC:L). Exploitation via CSRF enables the storage of XSS payloads, resulting in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) with changed scope (S:C), as reflected in the CVSS v3.1 base score of 7.1.
The Patchstack advisory provides further details on this WordPress plugin vulnerability, including vulnerability assessment and recommendations: https://patchstack.com/database/Wordpress/Plugin/insert-code/vulnerability/wordpress-insert-code-plugin-2-4-csrf-to-stored-xss-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7881
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in BCS Website Solutions Insert Code insert-code allows Stored XSS.This issue affects Insert Code: from n/a through <= 2.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CSRF to stored XSS vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and facilitates execution of arbitrary JavaScript code via XSS (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and correction of the specific CSRF to stored XSS flaw in the Insert Code WordPress plugin, eliminating the vulnerability through patching.
Enforces session authenticity mechanisms, such as anti-CSRF tokens, to prevent attackers from forging requests that store malicious XSS payloads in the plugin.
Mandates validation of information inputs to the Insert Code functionality, blocking malicious XSS payloads from being accepted and stored even if a forged request occurs.