CVE-2025-28964: Personal Favicon CSRF Vulnerability

CVE-2025-28964 Overview

CVE-2025-28964 is a Cross-Site Request Forgery (CSRF) vulnerability in the mangup Personal Favicon WordPress plugin that allows attackers to perform Stored Cross-Site Scripting (XSS) attacks. This chained vulnerability enables malicious actors to trick authenticated administrators into unknowingly executing state-changing requests, which can then persist malicious scripts within the WordPress site.

Critical Impact
Attackers can leverage CSRF to inject persistent malicious JavaScript code that executes in the browsers of site visitors and administrators, potentially leading to session hijacking, credential theft, and full site compromise.

Affected Products

Personal Favicon WordPress Plugin version 2.0 and earlier
WordPress sites running vulnerable versions of the personal-favicon plugin

Discovery Timeline

2025-06-06 - CVE-2025-28964 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28964

Vulnerability Analysis

This vulnerability combines two distinct attack vectors into a chained exploit. The Personal Favicon plugin lacks proper CSRF token validation on its administrative forms, allowing attackers to forge requests that appear to originate from authenticated administrators. When combined with insufficient input sanitization, the CSRF vulnerability enables the injection of persistent XSS payloads into the plugin's settings.

The attack requires user interaction—specifically, an authenticated administrator must be tricked into visiting a malicious page or clicking a crafted link while logged into their WordPress dashboard. Once the CSRF request is processed, the injected script is stored server-side and executes whenever the affected page is rendered.

Root Cause

The root cause stems from the absence of nonce verification in the plugin's form handling functions. WordPress provides the wp_nonce_field() and wp_verify_nonce() functions specifically to prevent CSRF attacks, but the Personal Favicon plugin fails to implement these security controls. Additionally, the plugin does not properly sanitize or escape user-supplied input before storing it in the database, enabling the XSS payload persistence.

Attack Vector

The attack is network-based and requires social engineering to trick an administrator into performing an action. An attacker would craft a malicious HTML page containing a hidden form that auto-submits to the vulnerable plugin endpoint when visited. The form would contain XSS payload data designed to be stored in the plugin's favicon configuration settings.

The stored XSS payload then executes in the context of any user viewing pages where the favicon configuration is rendered, potentially including:

The WordPress admin dashboard
Public-facing pages where the favicon is displayed
Plugin settings pages

This allows attackers to steal administrator session cookies, inject cryptocurrency miners, redirect users to phishing sites, or perform additional actions with the administrator's privileges.

Detection Methods for CVE-2025-28964

Indicators of Compromise

Unexpected changes to favicon settings in the Personal Favicon plugin configuration
Presence of <script> tags or JavaScript event handlers in plugin database entries
Unusual outbound requests from the WordPress admin interface to unknown domains
Reports from users about unexpected behavior or redirects on the website

Detection Strategies

Review WordPress database entries related to the personal-favicon plugin for suspicious content containing JavaScript code
Monitor HTTP access logs for POST requests to the plugin's settings endpoints that originate from external referrers
Implement Content Security Policy (CSP) headers to detect and block unauthorized script execution
Use WordPress security plugins to scan for stored XSS patterns in the database

Monitoring Recommendations

Enable detailed logging for WordPress admin actions, particularly plugin settings changes
Configure web application firewalls (WAF) to detect CSRF attack patterns targeting WordPress plugins
Set up alerts for modifications to the personal-favicon plugin configuration outside of normal administrative activity
Monitor browser console errors that may indicate blocked XSS attempts

How to Mitigate CVE-2025-28964

Immediate Actions Required

Deactivate and remove the Personal Favicon plugin from all WordPress installations until a patched version is available
Audit the plugin's database entries for any signs of injected malicious content
Review administrator session logs for evidence of unauthorized configuration changes
Implement a Web Application Firewall (WAF) with CSRF and XSS protection rules

Patch Information

As of the last update, no official patch has been confirmed for this vulnerability. Site administrators should check the Patchstack WordPress Vulnerability Database for the latest remediation guidance and monitor for plugin updates from the developer.

Workarounds

Disable the Personal Favicon plugin entirely and use alternative favicon implementation methods such as theme-based solutions or direct HTML modifications
Implement strict Content Security Policy headers to mitigate XSS execution even if payloads are injected
Restrict access to WordPress admin interfaces to trusted IP addresses only
Use browser extensions or proxy rules to block auto-form submissions to vulnerable endpoints

bash

# Example: Add Content Security Policy header in .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"

# Example: Restrict admin access by IP in .htaccess
<Files wp-admin>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Files>