What is the CVSS score of CVE-2025-28894?

CVE-2025-28894 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-28894?

Within 24 hours: Disable the 'List of Posts from each Category' plugin and audit installed version against the affected range (≤2.0). Within 7 days: Contact plugin vendor (Patchstack) for patch timeline or consider alternative plugins with equivalent functionality; review WordPress admin access logs for suspicious POST requests to plugin settings pages. Within 30 days: After patch release, test in staging environment, update to patched version, and implement Web Application Firewall (WAF) rules to filter CSRF tokens from untrusted sources as interim measure.

List of Posts from each Category CVE-2025-28894

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-03-11 audit@patchstack.com

WordPress XSS CSRF

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 25, 2026 - 00:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 19:52 vuln.today

CVE Published

Mar 11, 2025 - 21:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress allows Stored XSS. This issue affects List of Posts from each Category plugin for WordPress: from n/a through 2.0.

AnalysisAI

Stored XSS via CSRF vulnerability in the List of Posts from each Category WordPress plugin (versions up to 2.0) allows remote attackers to inject persistent malicious scripts into the site by tricking an authenticated administrator into submitting a crafted request. The CSRF weakness (CWE-352) enables the XSS payload delivery without direct admin interaction with malicious content. Publicly disclosed via Patchstack with low EPSS score (0.05%, 14th percentile), indicating minimal observed exploitation attempts despite network-based attack vector requiring only user interaction.

Technical ContextAI

This is a CSRF-to-XSS chain vulnerability in a WordPress plugin that displays categorized post listings. The CSRF flaw (CWE-352) stems from missing or inadequate nonce validation on administrative functions that accept user input for display configuration. When an authenticated WordPress administrator with plugin management privileges is socially engineered to visit an attacker-controlled page or click a malicious link while logged into their WordPress dashboard, the CSRF triggers a forged request that submits XSS payloads. These payloads are stored in the WordPress database (likely in plugin settings or widget configurations) and subsequently rendered to other users viewing the affected pages. The changed scope (S:C) in the CVSS vector indicates the XSS executes in the victim's browser context beyond the vulnerable plugin component itself. CPE data not provided; affected product identified as 'list-posts-by-category' WordPress plugin maintained by frucomerci, versions through 2.0.

Affected ProductsAI

The vulnerability affects the List of Posts from each Category plugin for WordPress developed by frucomerci, impacting all versions from the initial release through version 2.0 inclusive. The plugin WordPress.org slug is 'list-posts-by-category'. According to Patchstack database reference, installations running version 2.0 or earlier are vulnerable to this CSRF-to-stored-XSS attack chain. No specific WordPress core version requirements are documented, but the plugin requires WordPress with admin dashboard functionality and user authentication capabilities.

RemediationAI

Upgrade the List of Posts from each Category plugin to a patched version newer than 2.0 if available through the WordPress plugin repository or vendor channels. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/list-posts-by-category/vulnerability/wordpress-list-of-posts-from-each-category-plugin-for-wordpress-plugin-2-0-csrf-to-stored-xss-vulnerability for specific patch version guidance and release timeline. If no patched version is confirmed available, implement compensating controls: disable or uninstall the plugin if not business-critical (eliminates attack surface entirely); restrict WordPress admin dashboard access to trusted IP ranges via firewall rules or .htaccess (reduces CSRF exposure but impacts admin mobility); implement Content Security Policy headers to mitigate XSS execution (defense-in-depth, but may break legitimate plugin JavaScript functionality); train administrators to verify WordPress nonce tokens in URLs and avoid clicking external links while authenticated to wp-admin (relies on user discipline). As an additional layer, review plugin settings and widget configurations for suspicious JavaScript or HTML injection that may indicate prior compromise.