CVE-2025-28926: Post Read Time Plugin Stored XSS Vulnerability

CVE-2025-28926 Overview

CVE-2025-28926 is a stored cross-site scripting (XSS) vulnerability in the popeating Post Read Time plugin for WordPress. The flaw affects all plugin versions up to and including 1.2.6. It results from improper neutralization of input during web page generation, classified as [CWE-79]. An authenticated attacker with high privileges can inject persistent JavaScript payloads that execute in the browser of any user who loads the affected page. Because the injected script executes in a different security scope, the vulnerability has a changed scope and can impact site visitors and administrators.

Critical Impact
Authenticated attackers can inject persistent JavaScript into WordPress pages, enabling session theft, administrative account takeover, and redirection of visitors to attacker-controlled content.

Affected Products

popeating Post Read Time plugin for WordPress
All versions from n/a through 1.2.6
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-03-11 - CVE-2025-28926 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28926

Vulnerability Analysis

The Post Read Time plugin fails to sanitize user-supplied input before rendering it in generated web pages. An attacker with elevated WordPress privileges can submit crafted input containing HTML or JavaScript markup. The plugin stores this payload and later returns it in server responses without proper output encoding. When a legitimate user visits an affected page, the browser parses and executes the injected script under the origin of the WordPress site.

Exploitation requires both high privileges and user interaction, which limits mass exploitation. However, the stored nature of the payload means it persists across sessions and affects every visitor to the compromised page until removed. The EPSS score of 0.28% reflects low likelihood of widespread automated exploitation.

Root Cause

The root cause is missing input sanitization and output encoding within the plugin's page-generation logic. WordPress provides helpers such as wp_kses, esc_html, and esc_attr for neutralizing untrusted content. The plugin does not apply these functions to fields that flow into rendered output, allowing raw markup to reach the DOM.

Attack Vector

An authenticated user with high privileges submits a malicious payload through a plugin input field. The payload is stored in the WordPress database. When any user, including administrators or unauthenticated visitors, loads a page that renders the stored value, the browser executes the injected script. Attackers can use this to steal authentication cookies, perform actions as the current user, or deliver secondary payloads.

See the Patchstack WordPress Plugin Vulnerability advisory for additional technical details.

Detection Methods for CVE-2025-28926

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs stored in Post Read Time plugin configuration fields or post metadata
Outbound requests from browsers loading WordPress pages to unfamiliar third-party domains
Unusual creation of administrative accounts or modification of user roles following a privileged user session
Session cookies appearing in web server logs as query parameters to external hosts

Detection Strategies

Review WordPress database tables wp_options and wp_postmeta for entries associated with the post-read-time plugin containing HTML or JavaScript syntax
Enable and audit WordPress activity logs for changes made by high-privilege accounts to plugin settings
Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution on WordPress front-end pages

Monitoring Recommendations

Monitor administrative logins and correlate with subsequent modifications to plugin data
Alert on web application firewall (WAF) blocks targeting XSS patterns on wp-admin endpoints
Track version inventory of installed WordPress plugins to identify sites still running Post Read Time 1.2.6 or earlier

How to Mitigate CVE-2025-28926

Immediate Actions Required

Deactivate the Post Read Time plugin on all WordPress sites until a patched release is confirmed available
Audit plugin configuration and stored post metadata for injected script content and remove any malicious entries
Rotate credentials and invalidate active sessions for all high-privilege WordPress accounts
Restrict high-privilege role assignments to a minimal set of trusted administrators

Patch Information

At the time of publication, no fixed version beyond 1.2.6 is referenced in the advisory. Site operators should monitor the Patchstack advisory and the WordPress plugin repository for an updated release, then upgrade immediately when available.

Workarounds

Uninstall the plugin if read-time functionality is not business-critical
Deploy a WAF rule set that blocks XSS payload patterns on WordPress administrative endpoints
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Limit accounts with editor or administrator privileges and require multi-factor authentication for those roles

bash

# Configuration example: disable the plugin using WP-CLI
wp plugin deactivate post-read-time
wp plugin uninstall post-read-time

# Verify no residual plugin options remain
wp option list --search='*post_read_time*'