CVE-2025-28860 Overview
CVE-2025-28860 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the PPDPurveyor Google News Editors Picks Feed Generator WordPress plugin. The flaw affects all versions up to and including 2.1. Attackers can chain the CSRF weakness with a Stored Cross-Site Scripting (XSS) payload to inject persistent malicious scripts into the WordPress site. Exploitation requires an authenticated administrator to visit an attacker-controlled page while logged into WordPress. Once triggered, the injected script executes in the browser of any user who views the affected page.
Critical Impact
An attacker can persistently inject JavaScript into a WordPress site by tricking an authenticated administrator into visiting a malicious URL, leading to session theft, content tampering, or administrative takeover.
Affected Products
- PPDPurveyor Google News Editors Picks Feed Generator (WordPress plugin)
- All versions from n/a through <= 2.1
- WordPress installations using the google-news-editors-picks-news-feeds plugin
Discovery Timeline
- 2025-03-11 - CVE-2025-28860 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-28860
Vulnerability Analysis
The Google News Editors Picks Feed Generator plugin exposes administrative form handlers that do not validate anti-CSRF tokens. This omission allows attackers to forge state-changing requests on behalf of an authenticated administrator. When paired with insufficient input sanitization on stored plugin settings, forged requests can write attacker-controlled JavaScript into the plugin's persistent data. The stored payload then executes each time the affected page is rendered. User interaction is required, since the administrator must load an attacker-crafted page while logged in.
Root Cause
The root cause is the absence of proper CSRF protection, such as WordPress wp_nonce_field() and check_admin_referer() verification, on the plugin's settings handlers. Combined with missing output encoding and input sanitization on stored values, this allows persistent script injection through forged administrative requests [CWE-352].
Attack Vector
Exploitation occurs over the network and requires no privileges on the target site, though the victim must be an authenticated administrator. The attacker hosts a malicious HTML page containing a hidden form or JavaScript that submits a crafted request to the vulnerable plugin endpoint. When the administrator visits the page, their browser sends the authenticated request. The plugin accepts the request, stores the attacker-controlled payload, and later renders it as executable JavaScript. Refer to the Patchstack WordPress Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2025-28860
Indicators of Compromise
- Unexpected <script> tags or JavaScript event handlers stored in the plugin's WordPress options or post metadata.
- Outbound HTTP requests from administrator browsers to unknown domains after visiting external links.
- Modifications to the google-news-editors-picks-news-feeds plugin configuration outside of scheduled administrative activity.
- Referer headers on plugin POST requests pointing to external, non-WordPress domains.
Detection Strategies
- Audit the wp_options table and plugin-specific database entries for HTML or JavaScript content that should not be present.
- Monitor WordPress admin request logs for state-changing POST requests to plugin endpoints without a valid nonce parameter.
- Deploy a Web Application Firewall (WAF) rule to flag cross-origin requests targeting the plugin's administrative actions.
Monitoring Recommendations
- Enable WordPress activity logging to record all plugin setting changes with user attribution and source IP.
- Alert on browser Content Security Policy (CSP) violations originating from WordPress admin pages.
- Review scheduled feed content for unauthorized inline scripts before publication.
How to Mitigate CVE-2025-28860
Immediate Actions Required
- Deactivate the Google News Editors Picks Feed Generator plugin until a patched version is available.
- Audit stored plugin settings and remove any injected HTML or JavaScript payloads.
- Force password resets for administrator accounts that may have interacted with the vulnerable plugin.
- Review recent posts and feed outputs for tampering.
Patch Information
No fixed version has been published at the time of this advisory. The vulnerability affects all versions through 2.1. Monitor the Patchstack WordPress Vulnerability Advisory for updates from the vendor.
Workarounds
- Remove or disable the plugin entirely until the maintainer releases a patched version with proper nonce validation.
- Restrict WordPress admin access by IP allowlisting at the web server or WAF layer.
- Require administrators to use a dedicated browser profile for WordPress management to prevent cross-site request forgery from unrelated tabs.
- Deploy a strict Content Security Policy (CSP) on the WordPress site to limit inline script execution.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
