CVE-2025-28933: MaxA/B Plugin CSRF Vulnerability

CVE-2025-28933 Overview

CVE-2025-28933 is a Cross-Site Request Forgery (CSRF) vulnerability in the maxfoundry MaxA/B WordPress plugin that enables attackers to perform Stored Cross-Site Scripting (XSS) attacks. This chained vulnerability allows an attacker to trick an authenticated administrator into executing malicious requests, ultimately injecting persistent malicious scripts into the WordPress site.

Critical Impact

Attackers can leverage CSRF to bypass authentication and inject persistent XSS payloads that execute in the context of any user viewing the affected pages, potentially leading to session hijacking, credential theft, or site defacement.

Affected Products

• MaxA/B WordPress Plugin versions up to and including 2.2.2

Discovery Timeline

• 2025-03-11 - CVE-2025-28933 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-28933

Vulnerability Analysis

This vulnerability represents a classic CSRF-to-XSS attack chain in the MaxA/B WordPress plugin. The MaxA/B plugin, used for A/B testing functionality on WordPress sites, fails to implement proper CSRF protections on sensitive form submissions. This allows attackers to craft malicious requests that, when executed by an authenticated administrator, inject persistent JavaScript code into the plugin's stored data.

The absence of nonce verification on state-changing operations means the plugin cannot distinguish between legitimate administrator actions and forged requests initiated by an attacker. Once the malicious script is stored, it executes whenever users access the affected administrative pages or frontend elements.

Root Cause

The root cause of CVE-2025-28933 is the lack of CSRF token validation (WordPress nonces) in the MaxA/B plugin's form handling functions. WordPress provides built-in nonce functionality through wp_nonce_field() and wp_verify_nonce() functions, but the vulnerable versions of MaxA/B fail to implement these security measures. Additionally, the plugin does not properly sanitize or escape user input before storing it in the database, enabling the stored XSS component of this attack chain.

Attack Vector

The attack vector for this vulnerability involves social engineering combined with web-based exploitation. An attacker must craft a malicious HTML page or email containing a hidden form that automatically submits to the vulnerable MaxA/B plugin endpoint. When an authenticated WordPress administrator visits the attacker's page or clicks a malicious link, the browser automatically sends the forged request with the administrator's session cookies.

The malicious payload typically includes JavaScript code that gets stored in the plugin's database. This stored script then executes in the browsers of any users who subsequently view the affected content, enabling:

• Session cookie theft and account takeover
• Administrative action execution on behalf of victims
• Keylogging and credential harvesting
• Malware distribution through drive-by downloads
• Site defacement or content manipulation

Detection Methods for CVE-2025-28933

Indicators of Compromise

• Unexpected or unauthorized JavaScript code in MaxA/B plugin settings or test configurations
• Suspicious outbound connections to unknown domains originating from the WordPress admin interface
• Unusual database entries in MaxA/B plugin tables containing <script> tags or event handlers
• Admin session anomalies such as multiple simultaneous logins or actions from unexpected IP addresses

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect CSRF attack patterns targeting WordPress plugin endpoints
• Enable WordPress audit logging plugins to track all changes to MaxA/B plugin settings
• Monitor HTTP requests for missing or invalid nonce parameters on state-changing operations
• Deploy endpoint detection solutions that can identify malicious JavaScript execution in browser contexts

Monitoring Recommendations

• Configure alerts for any modifications to MaxA/B plugin configurations outside of normal maintenance windows
• Monitor database tables associated with the MaxA/B plugin for entries containing HTML or JavaScript code
• Implement Content Security Policy (CSP) headers to restrict inline script execution and detect violations
• Review server access logs for suspicious POST requests to MaxA/B plugin AJAX handlers

How to Mitigate CVE-2025-28933

Immediate Actions Required

• Update the MaxA/B plugin to a patched version when available from the vendor
• Temporarily deactivate the MaxA/B plugin if A/B testing functionality is not immediately critical
• Review and audit all existing MaxA/B plugin configurations for any injected malicious content
• Implement a Web Application Firewall with CSRF protection rules as a compensating control

Patch Information

At the time of publication, users should monitor the Patchstack WordPress Vulnerability Report for updates on available patches. Contact the maxfoundry vendor directly for remediation guidance and timeline information on security updates.

Workarounds

• Restrict access to the WordPress admin dashboard to trusted IP addresses only using .htaccess or server firewall rules
• Implement additional browser-based CSRF protections using security plugins that add nonce verification to plugin forms
• Educate administrators to avoid clicking untrusted links while logged into WordPress admin sessions
• Consider using a dedicated browser profile for WordPress administration that is not used for general web browsing

# Restrict wp-admin access by IP in .htaccess
# Add to /wp-admin/.htaccess
<IfModule mod_authz_core.c>
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</IfModule>

# Alternative: Block direct access to MaxA/B plugin files
<FilesMatch "maxab.*\.php$">
    <IfModule mod_authz_core.c>
        Require ip 192.168.1.0/24
    </IfModule>
</FilesMatch>