CVE-2025-28925: WATI Chat CSRF and Stored XSS Vulnerability

CVE-2025-28925 Overview

CVE-2025-28925 is a Cross-Site Request Forgery (CSRF) vulnerability in the WATI Chat and Notification WordPress plugin developed by Hieu Nguyen. The flaw affects all plugin versions up to and including 1.1.2. An attacker can chain the CSRF weakness with insufficient output encoding to achieve Stored Cross-Site Scripting (XSS). Successful exploitation requires tricking an authenticated administrator into clicking a crafted link or visiting an attacker-controlled page. The injected script then executes in the browser context of any user viewing the affected WordPress page. The weakness is tracked under CWE-352.

Critical Impact

An unauthenticated attacker can persistently inject JavaScript into a WordPress site by abusing the trust of an authenticated administrator, leading to session theft, admin account takeover, and arbitrary frontend script execution.

Affected Products

• WATI Chat and Notification plugin for WordPress (wati-chat-and-notification)
• All versions from n/a through 1.1.2
• Vendor: Hieu Nguyen

Discovery Timeline

• 2025-03-11 - CVE-2025-28925 published to the National Vulnerability Database
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28925

Vulnerability Analysis

The vulnerability stems from missing CSRF protections on state-changing requests handled by the WATI Chat and Notification plugin. State-changing endpoints accept POST requests without validating a WordPress nonce or verifying the request origin. An attacker hosts a malicious page that automatically submits a forged request to the targeted WordPress site. When an authenticated administrator visits this page, the browser submits the request with valid session cookies.

Because the plugin also fails to sanitize or encode the submitted input, the attacker's payload is stored persistently in plugin settings or content. The stored payload is later rendered in the page output, executing JavaScript in the browser of every visitor or administrator who views the affected page. This combination of CSRF and missing output encoding elevates the impact from a single-victim CSRF to a persistent script injection.

Root Cause

The root cause is the absence of anti-CSRF tokens on form submissions and AJAX handlers, combined with insufficient sanitization of user-supplied input before storage. WordPress provides wp_nonce_field() and check_admin_referer() primitives that the plugin does not invoke on the affected endpoints. User input is written to the database without filtering via sanitize_text_field() or wp_kses().

Attack Vector

Exploitation requires network access to the victim's WordPress site and user interaction from an authenticated administrator. The attacker delivers a malicious link via phishing email, forum post, or social media. When the administrator clicks the link, the browser issues a cross-origin request to the WordPress site that persists the attacker's payload. The stored script subsequently runs in the security context of the WordPress site for any user rendering the compromised page. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-28925

Indicators of Compromise

• Unexpected <script>, <iframe>, or event-handler attributes (e.g., onerror, onload) stored in WATI plugin settings or options tables.
• WordPress wp_options or plugin-specific tables containing encoded JavaScript payloads such as javascript:, String.fromCharCode, or base64-encoded blobs.
• Outbound HTTP requests from administrator browsers to unknown domains shortly after viewing WordPress admin pages.
• New or modified administrator accounts following an admin session interacting with the plugin.

Detection Strategies

• Review the wp-content/plugins/wati-chat-and-notification/ directory and confirm the installed version against the vendor's repository.
• Search the WordPress database for HTML or JavaScript artifacts inside plugin configuration fields that should contain only plain text.
• Inspect web server access logs for POST requests to plugin endpoints lacking a Referer header matching the site domain.
• Correlate administrator login sessions with subsequent POST requests originating from cross-site contexts.

Monitoring Recommendations

• Enable WordPress audit logging to record option and settings changes performed by administrative users.
• Deploy a Content Security Policy (CSP) that blocks inline scripts and unauthorized external script sources, then monitor CSP violation reports.
• Alert on file integrity changes within the wp-content/plugins/ directory and unexpected modifications to the WordPress database.

How to Mitigate CVE-2025-28925

Immediate Actions Required

• Deactivate the WATI Chat and Notification plugin until a patched version is confirmed available from the vendor.
• Audit plugin settings and content fields for injected scripts and remove any malicious payloads from the database.
• Force a password reset for all WordPress administrator accounts and invalidate active sessions.
• Review user roles and remove unauthorized accounts created during the exposure window.

Patch Information

As of the last NVD update, no fixed version has been published for the WATI Chat and Notification plugin. Monitor the Patchstack Vulnerability Report and the official WordPress plugin repository for updates beyond version 1.1.2.

Workarounds

• Uninstall the plugin if business requirements do not mandate its use.
• Restrict WordPress administrator access to trusted IP ranges using web server rules or a Web Application Firewall (WAF).
• Configure a WAF rule to enforce same-origin Referer validation on POST requests to /wp-admin/ plugin endpoints.
• Train administrators to avoid clicking untrusted links while logged into the WordPress admin console and to use a separate browser profile for administrative tasks.

# Example WAF rule (ModSecurity) to block cross-origin POSTs to WordPress admin
SecRule REQUEST_METHOD "@streq POST" \
    "chain,id:1002825,phase:1,deny,status:403,msg:'Cross-origin POST to wp-admin blocked'"
  SecRule REQUEST_URI "@beginsWith /wp-admin/" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example.com/" "t:none"