CVE-2025-28905: Featured Posts Grid Stored XSS Vulnerability

CVE-2025-28905 Overview

CVE-2025-28905 is a stored Cross-Site Scripting (XSS) vulnerability in the Chaser324 Featured Posts Grid WordPress plugin. The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects all versions of the featured-posts-grid plugin up to and including version 1.7.

The vulnerability is chained from a Cross-Site Request Forgery (CSRF) weakness, allowing an unauthenticated attacker to trick an authenticated administrator into submitting a malicious request. The injected payload persists in plugin settings and executes in the browser of any user viewing affected pages.

Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in administrator sessions, potentially leading to account takeover, session theft, and persistent site compromise.

Affected Products

Chaser324 Featured Posts Grid WordPress plugin versions through 1.7
WordPress installations with the featured-posts-grid plugin active
Administrator accounts authenticated to vulnerable WordPress sites

Discovery Timeline

2025-03-11 - CVE-2025-28905 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28905

Vulnerability Analysis

The Featured Posts Grid plugin fails to sanitize and escape user-supplied input before storing it in the WordPress database and rendering it back in generated web pages. This classic stored XSS pattern [CWE-79] allows arbitrary JavaScript to persist across sessions and execute in the context of the vulnerable site's origin.

The issue is compounded by missing CSRF protections on plugin configuration endpoints. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently submits a request injecting JavaScript into plugin settings. The payload then triggers whenever an affected page renders.

Exploitation requires user interaction, typically tricking an admin into clicking a crafted link. The scope is changed because injected scripts execute in the security context of the target WordPress site, beyond the vulnerable component itself.

Root Cause

The root cause is improper neutralization of input during web page generation. Plugin code paths handling settings input neither validate nor escape HTML and JavaScript metacharacters. WordPress sanitization helpers such as sanitize_text_field() and output escaping functions like esc_html() or esc_attr() are not applied consistently.

Attack Vector

The attack is network-based and requires no authentication on the attacker side. The attacker hosts a CSRF payload that targets the plugin's settings handler. When a logged-in administrator visits the attacker-controlled page, the browser submits the forged request, persisting a JavaScript payload into the plugin configuration. Subsequent page renders execute the script in visitors' browsers.

See the Patchstack Vulnerability Report for additional technical details on the CSRF-to-stored-XSS chain.

Detection Methods for CVE-2025-28905

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror=, onload=), or javascript: URIs stored in wp_options rows associated with the featured-posts-grid plugin.
Outbound requests from administrator browsers to unknown domains immediately after visiting the WordPress admin dashboard.
New or modified administrator accounts created shortly after a successful admin session on a site running featured-posts-grid <= 1.7.

Detection Strategies

Audit WordPress database tables for HTML or JavaScript artifacts inside plugin option values, focusing on featured_posts_grid keys.
Inspect HTTP referer logs for POST requests to plugin admin endpoints originating from external domains, indicating CSRF.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution from injected payloads.

Monitoring Recommendations

Enable WordPress activity logging to track plugin settings changes and correlate them with administrator session origins.
Monitor web server logs for anomalous POST requests to /wp-admin/admin.php or /wp-admin/options.php lacking same-origin referers.
Alert on JavaScript execution patterns associated with cookie exfiltration or unauthorized fetch requests in browser telemetry.

How to Mitigate CVE-2025-28905

Immediate Actions Required

Deactivate and remove the Featured Posts Grid plugin if no patched version is available for your installation.
Review and sanitize existing plugin configuration entries in the database, removing any HTML or script content.
Force password resets and session invalidation for all administrator accounts on affected sites.

Patch Information

At the time of publication, no fixed version beyond 1.7 was identified in the available references. Consult the Patchstack Vulnerability Report for the latest remediation status and any vendor-supplied updates.

Workarounds

Restrict access to the WordPress administration interface using IP allowlisting at the web server or WAF layer.
Deploy a web application firewall rule to block requests containing script tags or event handlers in plugin settings parameters.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources to limit XSS impact.
Require administrators to use isolated browser profiles when managing WordPress, reducing CSRF exposure from concurrent sessions.

bash

# Example WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate featured-posts-grid
wp plugin delete featured-posts-grid