CVE-2025-28964: Personal Favicon CSRF Vulnerability

CVE-2025-28964 Overview

CVE-2025-28964 is a Cross-Site Request Forgery (CSRF) vulnerability in the mangup Personal Favicon WordPress plugin that allows attackers to perform Stored Cross-Site Scripting (XSS) attacks. This chained vulnerability enables malicious actors to trick authenticated administrators into unknowingly executing state-changing requests, which can then persist malicious scripts within the WordPress site.

Critical Impact

Attackers can leverage CSRF to inject persistent malicious JavaScript code that executes in the browsers of site visitors and administrators, potentially leading to session hijacking, credential theft, and full site compromise.

Affected Products

• Personal Favicon WordPress Plugin version 2.0 and earlier
• WordPress sites running vulnerable versions of the personal-favicon plugin

Discovery Timeline

• 2025-06-06 - CVE-2025-28964 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28964

Vulnerability Analysis

This vulnerability combines two distinct attack vectors into a chained exploit. The Personal Favicon plugin lacks proper CSRF token validation on its administrative forms, allowing attackers to forge requests that appear to originate from authenticated administrators. When combined with insufficient input sanitization, the CSRF vulnerability enables the injection of persistent XSS payloads into the plugin's settings.

The attack requires user interaction—specifically, an authenticated administrator must be tricked into visiting a malicious page or clicking a crafted link while logged into their WordPress dashboard. Once the CSRF request is processed, the injected script is stored server-side and executes whenever the affected page is rendered.

Root Cause

The root cause stems from the absence of nonce verification in the plugin's form handling functions. WordPress provides the wp_nonce_field() and wp_verify_nonce() functions specifically to prevent CSRF attacks, but the Personal Favicon plugin fails to implement these security controls. Additionally, the plugin does not properly sanitize or escape user-supplied input before storing it in the database, enabling the XSS payload persistence.

Attack Vector

The attack is network-based and requires social engineering to trick an administrator into performing an action. An attacker would craft a malicious HTML page containing a hidden form that auto-submits to the vulnerable plugin endpoint when visited. The form would contain XSS payload data designed to be stored in the plugin's favicon configuration settings.

The stored XSS payload then executes in the context of any user viewing pages where the favicon configuration is rendered, potentially including:

• The WordPress admin dashboard
• Public-facing pages where the favicon is displayed
• Plugin settings pages

This allows attackers to steal administrator session cookies, inject cryptocurrency miners, redirect users to phishing sites, or perform additional actions with the administrator's privileges.

Detection Methods for CVE-2025-28964

Indicators of Compromise

• Unexpected changes to favicon settings in the Personal Favicon plugin configuration
• Presence of <script> tags or JavaScript event handlers in plugin database entries
• Unusual outbound requests from the WordPress admin interface to unknown domains
• Reports from users about unexpected behavior or redirects on the website

Detection Strategies

• Review WordPress database entries related to the personal-favicon plugin for suspicious content containing JavaScript code
• Monitor HTTP access logs for POST requests to the plugin's settings endpoints that originate from external referrers
• Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
• Use WordPress security plugins to scan for stored XSS patterns in the database

Monitoring Recommendations

• Enable detailed logging for WordPress admin actions, particularly plugin settings changes
• Configure web application firewalls (WAF) to detect CSRF attack patterns targeting WordPress plugins
• Set up alerts for modifications to the personal-favicon plugin configuration outside of normal administrative activity
• Monitor browser console errors that may indicate blocked XSS attempts

How to Mitigate CVE-2025-28964

Immediate Actions Required

• Deactivate and remove the Personal Favicon plugin from all WordPress installations until a patched version is available
• Audit the plugin's database entries for any signs of injected malicious content
• Review administrator session logs for evidence of unauthorized configuration changes
• Implement a Web Application Firewall (WAF) with CSRF and XSS protection rules

Patch Information

As of the last update, no official patch has been confirmed for this vulnerability. Site administrators should check the Patchstack WordPress Vulnerability Database for the latest remediation guidance and monitor for plugin updates from the developer.

Workarounds

• Disable the Personal Favicon plugin entirely and use alternative favicon implementation methods such as theme-based solutions or direct HTML modifications
• Implement strict Content Security Policy headers to mitigate XSS execution even if payloads are injected
• Restrict access to WordPress admin interfaces to trusted IP addresses only
• Use browser extensions or proxy rules to block auto-form submissions to vulnerable endpoints

# Example: Add Content Security Policy header in .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"

# Example: Restrict admin access by IP in .htaccess
<Files wp-admin>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Files>