What is the CVSS score of CVE-2025-28966?

CVE-2025-28966 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-28966?

A high-severity CSRF vulnerability in the Recent Posts Slider Responsive plugin allows attackers to inject malicious code that persists on affected websites.

How to fix or mitigate CVE-2025-28966?

Within 24 hours: Identify all instances of Recent Posts Slider Responsive plugin across your WordPress environments and document affected systems. Within 7 days: Implement WAF rules to block suspicious POST requests to the plugin's vulnerable endpoints and disable the plugin if not critical to operations. Within 30 days: Monitor vendor for patch availability and establish a testing/deployment plan; consider alternative slider solutions if patch timeline is extended.

Wordpress Plugin CVE-2025-28966

EUVD-2025-17172 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-06 audit@patchstack.com

WordPress XSS CSRF Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17172

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in dilemma123 Recent Posts Slider Responsive allows Stored XSS. This issue affects Recent Posts Slider Responsive: from n/a through 1.0.1.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in the dilemma123 Recent Posts Slider Responsive WordPress plugin (versions through 1.0.1) that enables Stored XSS attacks. An unauthenticated attacker can craft malicious requests to inject persistent JavaScript payloads, which execute in the browsers of site administrators and visitors, potentially leading to account compromise, malware distribution, or defacement. The vulnerability requires user interaction (UI:R) but has network-accessible attack surface (AV:N) with moderate CVSS score of 7.1 and should be prioritized for patched WordPress installations running vulnerable plugin versions.

Technical ContextAI

The Recent Posts Slider Responsive plugin for WordPress (CPE: wp:dilemma123:recent-posts-slider-responsive) contains a CSRF vulnerability (CWE-352: Cross-Site Request Forgery) combined with insufficient input validation, allowing Stored XSS (CWE-79 derivative). The root cause stems from the plugin accepting and storing user-supplied data without proper CSRF token validation and output encoding. WordPress plugins are executed server-side with access to the wp_options and custom post metadata tables; when a CSRF attack bypasses nonce verification, attacker-controlled content becomes stored in the database. Upon rendering, the Stored XSS payload executes client-side in administrator dashboards or frontend pages, bypassing typical Content Security Policy protections that assume server-side origin trust. The slider functionality likely iterates over post metadata without sanitization before echoing to the DOM.

RemediationAI

Primary: Deactivate and uninstall the Recent Posts Slider Responsive plugin immediately if no patched version is available from the vendor.; priority: CRITICAL Secondary: Replace with an actively maintained slider plugin (e.g., Elementor, Slider Revolution, or native WordPress block-based alternatives). Audit plugin source code history on WordPress.org plugin repository for abandoned status.; priority: HIGH Mitigation (if removal not immediately possible): Implement Web Application Firewall (WAF) rules to block POST requests to the plugin's slider configuration endpoints lacking valid WordPress nonces; restrict plugin functionality to authenticated admin users only via .htaccess or security plugin rules.; priority: MEDIUM Detection: Audit wp_postmeta and wp_options tables for suspicious entries added during plugin operation; search for encoded JavaScript or iframe tags in slider configuration fields.; priority: HIGH Future Prevention: Enforce WordPress security best practices: use security plugins (Wordfence, Sucuri) with vulnerability scanning; monitor plugin update status; use Web Application Firewall with OWASP CRS.; priority: ONGOING