What is the CVSS score of CVE-2025-28950?

CVE-2025-28950 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-28950?

A stored cross-site scripting vulnerability in the David Shabtai Post Author plugin (versions through 1.1.1) allows attackers to inject malicious code that affects all site visitors.

How to fix or mitigate CVE-2025-28950?

Within 24 hours: Audit all post content for suspicious scripts and disable the Post Author plugin if not critical to operations. Within 7 days: Identify all affected systems, document inventory, and implement Web Application Firewall rules to block malicious payloads. Within 30 days: Monitor vendor security advisories for patch release; evaluate alternative plugins or custom solutions; implement content security policy headers and input validation controls.

Wordpress Plugin CVE-2025-28950

EUVD-2025-17167 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17167

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai Post Author allows Stored XSS. This issue affects Post Author: from n/a through 1.1.1.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai's Post Author WordPress plugin (versions through 1.1.1) that enables Stored Cross-Site Scripting (XSS) attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads that execute in the browsers of all users viewing affected content, potentially leading to account compromise, data theft, or malware distribution. The vulnerability has a CVSS score of 7.1 (High) with network-based attack vector and low complexity, indicating practical exploitability without authentication.

Technical ContextAI

The vulnerability stems from inadequate CSRF token validation (CWE-352) in the David Shabtai Post Author plugin, a WordPress plugin designed to manage and display post authorship information. The root cause is the failure to implement or properly verify anti-CSRF tokens on state-changing operations, allowing attackers to forge requests from victim browsers. The flaw is compounded by insufficient input sanitization, permitting the injection of malicious script content that persists in the database as Stored XSS. The plugin processes user-supplied data without proper escaping before output rendering, violating WordPress security best practices. This combination of CSRF + Stored XSS (rather than CSRF alone) significantly elevates the impact from session hijacking to persistent malicious script injection affecting all site visitors.

RemediationAI

Immediate remediation steps: (1) Deactivate and remove the David Shabtai Post Author plugin from all WordPress installations until a patched version is released; (2) Search the WordPress site database for suspicious content injected via the plugin (look for script tags or unusual modifications to post metadata); (3) If Stored XSS has been injected, sanitize database entries and audit user accounts for unauthorized access; (4) Monitor WordPress logs and user activity for signs of compromise. Long-term: update to the latest patched version once released by the vendor (version >1.1.1 or awaiting vendor advisory). Workaround: If the plugin is essential, temporarily restrict plugin access via WordPress user role management and implement Web Application Firewall (WAF) rules to block script injection patterns. Check the official WordPress.org plugin repository or vendor website for security advisories and patched releases.