CVE-2025-28883: WP Compare Tables CSRF Vulnerability

CVE-2025-28883 Overview

CVE-2025-28883 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Compare Tables WordPress plugin developed by Martin. This vulnerability allows attackers to chain CSRF with Stored Cross-Site Scripting (XSS), enabling malicious actors to inject persistent scripts into the WordPress site by tricking authenticated administrators into performing unintended actions.

The vulnerability exists in WP Compare Tables versions through 1.0.5 and allows attackers to bypass CSRF protections, subsequently storing malicious JavaScript payloads that execute whenever users view affected content.

Critical Impact

Attackers can leverage this CSRF-to-Stored-XSS chain to hijack administrator sessions, deface websites, redirect users to malicious sites, or establish persistent backdoor access to WordPress installations.

Affected Products

• WP Compare Tables plugin for WordPress versions through 1.0.5
• WordPress sites using vulnerable versions of wp-compare-tables plugin

Discovery Timeline

• 2025-03-11 - CVE-2025-28883 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-28883

Vulnerability Analysis

This vulnerability combines two distinct attack vectors into a dangerous exploit chain. The WP Compare Tables plugin fails to implement proper CSRF token validation on forms that handle table configuration or content submission. This missing validation allows attackers to craft malicious requests that authenticated administrators can unknowingly execute.

The lack of CSRF protection is compounded by insufficient input sanitization and output encoding, enabling the injection of Stored XSS payloads. When an administrator visits an attacker-controlled page containing a hidden form or malicious request, the CSRF vulnerability allows the attacker to submit arbitrary data to the plugin's backend. Because the plugin does not properly sanitize this input before storage or encode it before display, JavaScript code persists in the database and executes for all subsequent visitors.

Root Cause

The root cause of CVE-2025-28883 is twofold:

1. Missing CSRF Token Validation (CWE-352): The plugin does not verify WordPress nonces or implement other anti-CSRF mechanisms on sensitive form submissions, allowing cross-origin requests to be processed as legitimate.

2. Insufficient Input Sanitization: User-supplied data is stored without proper sanitization using functions like sanitize_text_field() or wp_kses(), and is rendered without escaping via esc_html() or esc_attr().

Attack Vector

The attack flow for CVE-2025-28883 proceeds as follows:

1. An attacker identifies a WordPress site running a vulnerable version of WP Compare Tables
2. The attacker crafts a malicious HTML page containing a hidden form that submits data to the vulnerable plugin endpoint
3. The form includes XSS payloads such as <script> tags or event handlers in table content fields
4. The attacker tricks a logged-in WordPress administrator into visiting the malicious page (via phishing, social engineering, or embedding in a compromised site)
5. The form auto-submits via JavaScript, and the malicious payload is stored in the WordPress database
6. When any user views pages containing the affected table comparison content, the stored XSS executes in their browser context

For detailed technical analysis, see the Patchstack security advisory.

Detection Methods for CVE-2025-28883

Indicators of Compromise

• Unexpected modifications to WP Compare Tables content or settings without administrator action
• JavaScript payloads or suspicious HTML tags stored in table comparison data within the WordPress database
• Browser console errors indicating blocked or executed inline scripts from unexpected sources
• User reports of redirects, pop-ups, or unusual behavior when viewing pages with comparison tables

Detection Strategies

• Review WordPress audit logs for unauthorized modifications to WP Compare Tables settings
• Scan database tables associated with the wp-compare-tables plugin for suspicious script tags or event handlers
• Monitor web server access logs for unusual POST requests to wp-compare-tables admin endpoints from external referrers
• Implement Content Security Policy (CSP) headers to detect and block unauthorized inline script execution

Monitoring Recommendations

• Enable WordPress activity logging plugins to track all administrative actions and plugin configuration changes
• Configure Web Application Firewall (WAF) rules to alert on CSRF attack patterns and XSS payloads in POST requests
• Regularly scan WordPress installations with security plugins capable of detecting stored XSS payloads
• Monitor browser error reporting for CSP violations that may indicate exploitation attempts

How to Mitigate CVE-2025-28883

Immediate Actions Required

• Immediately deactivate and remove the WP Compare Tables plugin from all WordPress installations until a patched version is available
• Audit all content created by the wp-compare-tables plugin for malicious JavaScript or HTML payloads
• Review WordPress user sessions and force logout of all administrative users as a precaution
• Check for any unauthorized WordPress administrator accounts or modified user privileges

Patch Information

No patched version has been confirmed at this time. The vulnerability affects WP Compare Tables versions through 1.0.5. Site administrators should monitor the Patchstack database and the WordPress plugin repository for security updates from the developer.

Workarounds

• Remove or deactivate the WP Compare Tables plugin entirely until a security patch is released
• If the plugin must remain active, restrict access to plugin settings pages using WordPress user role management or additional authentication
• Implement a Web Application Firewall (WAF) with rules to block CSRF attacks and XSS payloads targeting WordPress admin endpoints
• Add Content Security Policy headers to prevent execution of inline scripts and mitigate the impact of stored XSS

# Example: Adding CSP headers via .htaccess for Apache servers
# Add to your WordPress .htaccess file
<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"
</IfModule>