What is the CVSS score of CVE-2025-28860?

CVE-2025-28860 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Google News Editors Picks Feed Generator are affected by CVE-2025-28860?

CVE-2025-28860 affects the Google News Editors Picks Feed Generator WordPress plugin (versions 2.1 and earlier), introducing a CSRF vulnerability that can be chained into persistent stored XSS…

How to fix or mitigate CVE-2025-28860?

Within 24 hours: Audit WordPress plugins for Google News Editors Picks Feed Generator and document current version and deployment count. Within 7 days: Deactivate and remove the plugin entirely, or switch to an alternative news feed solution (no patched version exists). Implement Content Security Policy (CSP) headers with frame-ancestors and script-src restrictions to mitigate XSS chaining risk. Within 30 days: Review WordPress user access controls to enforce principle of least privilege for administrator accounts; audit activity logs for evidence of CSRF or XSS exploitation since deployment.

Google News Editors Picks Feed Generator CVE-2025-28860

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-03-11 audit@patchstack.com

WordPress XSS Google CSRF Wordpress Plugin Google News Editors Picks Feed Generator

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:47 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:42 NVD

MEDIUM HIGH

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.1 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Mar 12, 2026 - 19:52 vuln.today

CVE Published

Mar 11, 2025 - 21:15 nvd

MEDIUM 6.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator allows Stored XSS. This issue affects Google News Editors Picks Feed Generator: from n/a through 2.1.

AnalysisAI

Cross-Site Request Forgery (CSRF) in the Google News Editors Picks Feed Generator WordPress plugin (versions ≤2.1) enables attackers to chain exploitation into Stored XSS, allowing malicious scripts to persist in the site database and execute in administrator or user browsers. The attack requires tricking an authenticated administrator into visiting a malicious site or clicking a crafted link (UI:R). EPSS score is very low (0.05%, 14th percentile), indicating minimal real-world exploitation observed. No CISA KEV listing and no public POC identified at time of analysis.

Technical ContextAI

This vulnerability affects a WordPress plugin (CPE: cpe:2.3:a:ppdpurveyor:google_news_editors_picks_feed_generator:*:*:*:*:*:wordpress:*:*) that generates RSS/Atom feeds for Google News. The root cause is CWE-352 (Cross-Site Request Forgery), where the plugin fails to validate anti-CSRF tokens on state-changing operations. This CSRF weakness is chained with improper input sanitization, allowing an attacker to inject malicious JavaScript that gets stored in the WordPress database (Stored/Persistent XSS). The stored XSS then executes whenever administrators or users view the affected plugin pages. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component itself, as XSS payloads execute in victim browsers with their session privileges.

RemediationAI

Upstream fix availability not confirmed from available data sources - check WordPress plugin repository for versions newer than 2.1 or contact plugin author PPDPurveyor directly. If no patched version is available, implement compensating controls: (1) Remove or deactivate the Google News Editors Picks Feed Generator plugin if Google News feed functionality is not business-critical (eliminates attack surface entirely, no side effects if feed not used). (2) Restrict WordPress admin access to trusted IP ranges via .htaccess or firewall rules (reduces CSRF attack surface but limits legitimate remote admin access). (3) Educate administrators to verify URLs before clicking, especially in emails or external sites, and use dedicated browsers for WordPress admin sessions (reduces social engineering success but relies on user behavior). (4) Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in HTTP parameters sent to the plugin endpoints (may cause false positives on legitimate feed content). Monitor Patchstack database at https://patchstack.com/database/wordpress/plugin/google-news-editors-picks-news-feeds for patch release announcements.