CVE-2025-26550: Global Meta Keyword Plugin CSRF Flaw

CVE-2025-26550 Overview

CVE-2025-26550 is a Cross-Site Request Forgery (CSRF) vulnerability in the Kunal Shivale Global Meta Keyword & Description WordPress plugin that leads to Stored Cross-Site Scripting (XSS). The flaw affects all versions of the plugin up through 2.3. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, persists arbitrary JavaScript into the plugin's meta tag settings. The injected payload then executes in the browser of any visitor rendering pages that include the plugin's output.

Critical Impact
Successful exploitation persists attacker-controlled JavaScript site-wide, enabling session theft, administrative account takeover, and arbitrary client-side actions against any visitor.

Affected Products

Kunal Shivale Global Meta Keyword & Description plugin for WordPress
All versions from initial release through 2.3
WordPress sites using the global-meta-keyword-and-description plugin slug

Discovery Timeline

2025-02-13 - CVE-2025-26550 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26550

Vulnerability Analysis

The vulnerability stems from missing CSRF protection on the plugin's settings handler. The plugin fails to verify a valid WordPress nonce or origin before accepting state-changing POST requests that update the global meta keyword and description fields. Because the stored values are later rendered into HTML output without sufficient sanitization or contextual escaping, the CSRF flaw escalates into Stored XSS.

An attacker exploits this by hosting a page containing an auto-submitting form or fetch() call that targets the plugin's settings endpoint. When an authenticated WordPress administrator visits the malicious page, the browser sends authenticated cookies along with the forged request. The plugin processes the request and persists the attacker's JavaScript payload into the database.

This issue is classified under CWE-352: Cross-Site Request Forgery, with a chained Stored XSS impact.

Root Cause

The handler that saves plugin options does not validate a WordPress nonce via check_admin_referer() or wp_verify_nonce(), and does not sanitize input through wp_kses() or escape output with esc_attr() / esc_html() when emitting the saved values into the page's <meta> tags. Both controls are absent, allowing the chained CSRF-to-XSS condition.

Attack Vector

Exploitation requires user interaction: a logged-in administrator must visit an attacker-controlled URL. No prior authentication or privileges are needed by the attacker. Once the payload is stored, it executes automatically for any user whose browser renders the affected meta output, expanding impact across the site's visitor base. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-26550

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript appearing in the site's global meta keyword or description fields.
WordPress wp_options rows associated with the plugin containing HTML or JavaScript content rather than plain keyword text.
Outbound requests from visitor browsers to unknown domains shortly after page load on affected pages.

Detection Strategies

Audit the plugin's stored settings in the database for any non-text characters, angle brackets, or encoded payloads.
Review web server access logs for POST requests to the plugin's settings endpoint that lack a valid Referer header pointing to wp-admin.
Scan rendered page HTML for unexpected script content emitted within <meta> tags.

Monitoring Recommendations

Alert on administrator-initiated POST requests to plugin admin pages that originate from external referrers.
Monitor WordPress audit logs for option changes to the global-meta-keyword-and-description settings outside scheduled maintenance windows.
Track browser-side errors and Content Security Policy (CSP) violations on public pages, which may indicate injected scripts.

How to Mitigate CVE-2025-26550

Immediate Actions Required

Deactivate and remove the Global Meta Keyword & Description plugin until a patched version above 2.3 is published.
Inspect and sanitize any stored values in the plugin's options to remove injected HTML or JavaScript.
Rotate administrator credentials and invalidate active sessions if injection is suspected.

Patch Information

At the time of NVD publication, no fixed version is identified beyond 2.3. Site administrators should monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release that adds nonce verification and output escaping.

Workarounds

Replace the plugin with an actively maintained SEO or meta tag plugin that implements CSRF nonces and output escaping.
Deploy a Web Application Firewall (WAF) rule to block POST requests to the plugin's admin endpoint that lack a same-origin Referer and valid _wpnonce parameter.
Apply a strict Content Security Policy that disallows inline scripts to limit the impact of injected payloads.
Restrict WordPress administrator browsing to trusted sites and use separate browser profiles for admin sessions.

bash

# Example WAF rule concept (ModSecurity) to block cross-origin POSTs to plugin settings
SecRule REQUEST_METHOD "@streq POST" \
    "id:1002650,phase:1,deny,status:403,\
    chain,msg:'Block cross-origin POST to vulnerable plugin'"
    SecRule REQUEST_URI "@contains /wp-admin/options-general.php" \
        "chain"
        SecRule ARGS:page "@contains global-meta-keyword-and-description" \
            "chain"
            SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/wp-admin/"