CVE-2025-28966: Recent Posts Slider CSRF Vulnerability

CVE-2025-28966 Overview

CVE-2025-28966 is a Cross-Site Request Forgery (CSRF) vulnerability in the Recent Posts Slider Responsive WordPress plugin developed by dilemma123. The flaw affects all plugin versions up to and including 1.0.1. Attackers can chain the CSRF weakness with Stored Cross-Site Scripting (XSS) to inject persistent malicious payloads into the WordPress site. Successful exploitation requires a logged-in administrator to visit a crafted page or follow an attacker-supplied link. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact

An unauthenticated attacker can trick an administrator into submitting a forged request that stores malicious JavaScript, executing in any visitor's browser session.

Affected Products

• Recent Posts Slider Responsive plugin for WordPress
• All versions from initial release through 1.0.1
• Vendor: dilemma123

Discovery Timeline

• 2025-06-06 - CVE-2025-28966 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28966

Vulnerability Analysis

The Recent Posts Slider Responsive plugin fails to validate the origin or authenticity of state-changing HTTP requests sent to its administrative endpoints. The plugin does not enforce WordPress nonce verification using wp_verify_nonce() or check_admin_referer() on configuration handlers. Attackers leverage this oversight to forge requests that an authenticated administrator's browser will execute automatically.

The CSRF flaw combines with insufficient output encoding on stored configuration values, producing a Stored XSS condition. Once a malicious payload is saved into plugin settings, the script executes whenever the slider renders on a page. This expands the attack surface from a single targeted administrator to every site visitor who loads affected pages.

Root Cause

The root cause is the absence of CSRF protection tokens on plugin form submissions, compounded by missing sanitization on stored input. Without wp_nonce_field() in the form and a matching server-side verification call, the plugin treats any authenticated request as legitimate. Stored values are subsequently rendered without escaping through esc_attr() or esc_html(), enabling script execution in the rendered HTML output.

Attack Vector

An attacker hosts a malicious page containing a hidden form or JavaScript that auto-submits a POST request to the plugin's settings endpoint on the target WordPress site. The attacker then lures an administrator to the page through phishing, a forum link, or a comment. The administrator's authenticated session cookie is automatically attached, causing the WordPress site to accept the forged request and persist the attacker's XSS payload. See the Patchstack Security Advisory for additional technical context.

// No verified proof-of-concept code is published for this CVE.
// Refer to the Patchstack advisory linked above for details.

Detection Methods for CVE-2025-28966

Indicators of Compromise

• Unexpected <script> tags, event handlers, or obfuscated JavaScript embedded in plugin configuration fields or rendered slider HTML.
• Administrative POST requests to plugin endpoints lacking a valid _wpnonce parameter in web server access logs.
• New or modified plugin settings entries in the wp_options table created outside of normal administrator activity windows.

Detection Strategies

• Audit WordPress database tables for plugin option values containing HTML tags, JavaScript keywords, or encoded payloads such as javascript:, onerror=, or eval(.
• Correlate HTTP Referer headers on administrative requests against expected internal origins to identify cross-origin submissions.
• Deploy a Web Application Firewall (WAF) rule that flags POST requests to wp-admin endpoints missing nonce parameters.

Monitoring Recommendations

• Enable WordPress security plugin logging for administrator session activity and configuration changes.
• Monitor outbound traffic from site visitors for connections to unfamiliar domains that may indicate active XSS callbacks.
• Track file integrity on plugin directories and alert on unexpected modifications to plugin PHP files or settings.

How to Mitigate CVE-2025-28966

Immediate Actions Required

• Deactivate and remove the Recent Posts Slider Responsive plugin until a patched version is confirmed available.
• Force a password reset for all WordPress administrator accounts and invalidate active sessions.
• Inspect plugin settings and post content for injected scripts and remove any malicious payloads identified.

Patch Information

As of the latest NVD update on 2026-04-23, no fixed version is listed for the Recent Posts Slider Responsive plugin. Affected installations remain vulnerable through version 1.0.1. Review the Patchstack Security Advisory for current patch status and vendor remediation.

Workarounds

• Replace the plugin with an actively maintained alternative that implements nonce verification and output escaping.
• Restrict access to /wp-admin/ through IP allowlisting at the web server or WAF layer to reduce CSRF exposure.
• Require administrators to use a dedicated browser profile when managing WordPress to limit cross-site cookie availability.

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate recent-posts-slider-responsive
wp plugin delete recent-posts-slider-responsive