CVE-2025-28933

High

Published: 11 March 2025

Published

11 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0007 22.5th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28933 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-28933 is a Cross-Site Request Forgery (CSRF) vulnerability in the maxfoundry MaxA/B (maxab) WordPress plugin that enables Stored XSS. The issue affects MaxA/B versions from n/a through 2.2.2, as documented under CWE-352. It carries a CVSS v3.1 base score of 7.1, reflecting network accessibility with low attack complexity.

The vulnerability can be exploited by unauthenticated attackers over the network who trick authenticated users into interacting with a malicious request, such as clicking a crafted link or loading a malicious page. Successful exploitation changes the scope and allows limited impacts on confidentiality, integrity, and availability, primarily through the storage of XSS payloads that execute in the context of the victim's browser.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/maxab/vulnerability/wordpress-maxa-b-plugin-2-2-2-csrf-to-stored-xss-vulnerability?_s_id=cve details the CSRF-to-Stored XSS issue in WordPress MaxA/B plugin version 2.2.2. The vulnerability was published on 2025-03-11T21:15:51.290.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-7882

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in maxfoundry MaxA/B maxab allows Stored XSS.This issue affects MaxA/B: from n/a through <= 2.2.2.

CWE(s): CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

Why these techniques?

CSRF-to-Stored XSS in public-facing WordPress plugin directly maps to exploiting public-facing applications (T1190) and enables browser session hijacking via injected XSS payloads (T1185).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0