What is the CVSS score of CVE-2025-28948?

CVE-2025-28948 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2025-28948?

A high-severity CSRF and reflected XSS vulnerability exists in the Mediabay WordPress plugin (versions through 1.4) that could allow attackers to manipulate media library operations or steal…

How to fix or mitigate CVE-2025-28948?

Within 24 hours: Inventory all WordPress installations and identify those running Mediabay plugin version 1.4 or earlier. Within 7 days: Disable or remove the Mediabay plugin from all affected instances as a temporary mitigation, or implement WAF rules to block suspicious requests to the plugin. Within 30 days: Monitor the vendor's security advisories for patch availability and establish a patching plan; if no patch is released, evaluate alternative media management solutions.

WordPress CVE-2025-28948

EUVD-2025-17166 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress CSRF XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17166

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in the codedraft Mediabay WordPress plugin (versions up to 1.4) that enables reflected XSS attacks. Attackers can exploit this network-accessible vulnerability without authentication to perform unauthorized actions on behalf of authenticated users and inject malicious scripts, affecting WordPress installations using this media library plugin. The CVSS 7.1 score and absence of KEV/active exploitation data suggest moderate real-world risk with UI interaction required.

Technical ContextAI

The vulnerability exists in the Mediabay - WordPress Media Library Folders plugin, which extends WordPress's native media management capabilities. The underlying issue is a CSRF vulnerability (CWE-352) that fails to implement proper token validation (such as WordPress nonces) when processing state-changing requests. This allows an attacker to craft malicious cross-origin requests that, when visited by authenticated WordPress administrators or users, execute unvalidated actions within the plugin's context. The reflected XSS component indicates that user input is reflected in HTTP responses without proper sanitization or output encoding, compounding the attack surface. The plugin integrates directly with WordPress's media library infrastructure (likely wp-admin AJAX handlers or media upload/folder management endpoints), making administrative users primary targets.

RemediationAI

Immediate actions: (1) Update the Mediabay plugin to version 1.5 or later when available—vendors typically address CSRF via nonce implementation and XSS via output sanitization; (2) Review plugin changelog/vendor advisory (codedraft) for confirmation of patch scope; (3) Verify successful update in wp-admin > Plugins; (4) Monitor for suspicious media library activity in WordPress logs. Interim mitigations if patch unavailable: (a) Disable the plugin temporarily via wp-cli or wp-admin if not mission-critical; (b) Restrict plugin access via role-based capabilities; (c) Implement network-level CSRF protections (SameSite cookie attributes enforced at server level); (d) Educate administrators against clicking untrusted links while logged into WordPress; (e) Apply WordPress security hardening (disable file editing, restrict admin access by IP if feasible). Contact codedraft directly for patch ETA if version 1.5+ is not immediately available.