CVE-2025-46520: Related Posts via Taxonomies CSRF Flaw

CVE-2025-46520 Overview

CVE-2025-46520 is a Cross-Site Request Forgery (CSRF) vulnerability in the Related Posts via Taxonomies WordPress plugin developed by alphasis. The flaw affects all plugin versions up to and including 1.0.1. Attackers can exploit the missing CSRF protection to trick authenticated administrators into submitting forged requests that inject malicious JavaScript into stored plugin settings. The chained Stored Cross-Site Scripting (XSS) payload executes whenever a user views the affected output. The weakness is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact

Successful exploitation enables persistent JavaScript execution in administrator browsers, leading to session compromise, content tampering, and potential account takeover of WordPress sites running the vulnerable plugin.

Affected Products

• alphasis Related Posts via Taxonomies WordPress plugin
• Versions from n/a through 1.0.1 (inclusive)
• WordPress sites with the related-posts-via-taxonomies plugin installed and activated

Discovery Timeline

• 2025-04-24 - CVE-2025-46520 published to the National Vulnerability Database
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46520

Vulnerability Analysis

The Related Posts via Taxonomies plugin exposes administrative actions without enforcing anti-CSRF tokens. Requests that modify plugin configuration accept submissions from any origin as long as the victim's browser carries a valid authenticated session cookie. An attacker who lures an authenticated administrator to a malicious page can submit a forged form against the plugin's settings endpoint. Because the plugin also fails to sanitize input before storing it, the forged request plants attacker-controlled JavaScript into persistent storage. The payload then renders in administrative views or front-end output, producing a Stored XSS condition. Exploitation requires user interaction, which is reflected in the attack metrics, but no privileges on the target site are needed by the attacker. The chained outcome is broader than a typical CSRF, since the injected script persists across sessions and affects every user who loads the impacted page.

Root Cause

The root cause is the absence of CSRF nonce validation on state-changing requests handled by the plugin. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for this purpose, but the vulnerable handlers in version 1.0.1 and earlier do not invoke them. Compounding the issue, user-supplied input written to plugin options is not escaped on output, enabling the secondary Stored XSS.

Attack Vector

The attack proceeds over the network and requires the administrator to visit attacker-controlled content while authenticated to the target WordPress site. A crafted page issues an automatic POST request, often through a hidden form or fetch call, to the plugin's settings endpoint. The forged request stores an XSS payload such as a <script> tag or event-handler attribute in plugin configuration. When the configuration is rendered, the script executes in the context of the WordPress origin, granting the attacker the ability to manipulate the DOM, exfiltrate cookies that lack HttpOnly, or pivot to additional administrative actions. Refer to the Patchstack Vulnerability Report for the full technical writeup.

Detection Methods for CVE-2025-46520

Indicators of Compromise

• Unexpected <script> tags, onerror, onload, or javascript: payloads stored in plugin options under the wp_options table for related-posts-via-taxonomies.
• WordPress admin POST requests to plugin configuration endpoints with Referer headers pointing to external or untrusted domains.
• Outbound connections from administrator browsers to unfamiliar domains immediately after loading WordPress admin pages.
• New or modified administrator accounts created shortly after a settings update to the vulnerable plugin.

Detection Strategies

• Audit the wp_options table for plugin-related entries containing HTML or JavaScript tokens such as <script, onerror=, or javascript:.
• Review web server access logs for POST requests to plugin admin endpoints lacking valid _wpnonce parameters.
• Deploy a Web Application Firewall (WAF) rule that flags state-changing requests to /wp-admin/ endpoints with missing or invalid nonce values.
• Correlate browser telemetry showing script execution on admin pages with recent plugin configuration changes.

Monitoring Recommendations

• Enable WordPress audit logging to capture every settings change, with attribution to user and source IP.
• Monitor file integrity for the related-posts-via-taxonomies plugin directory to detect tampering.
• Alert on administrator session activity originating from anomalous geolocations or user agents.
• Track plugin version inventory across all WordPress instances to identify hosts still running 1.0.1 or earlier.

How to Mitigate CVE-2025-46520

Immediate Actions Required

• Deactivate and remove the Related Posts via Taxonomies plugin until a fixed release is confirmed by the vendor.
• Inspect plugin settings and the wp_options table for injected scripts and remove any malicious content.
• Rotate all administrator credentials and invalidate active WordPress sessions on affected sites.
• Review recent admin activity logs for unauthorized configuration changes or account creation.

Patch Information

No vendor-supplied patch is referenced in the NVD entry at the time of publication. The advisory tracks the vulnerability as affecting versions up to and including 1.0.1 with no fixed version listed. Site operators should monitor the Patchstack advisory and the WordPress plugin repository for an updated release that introduces wp_nonce_field() validation and proper output escaping.

Workarounds

• Remove the plugin and replace it with a maintained alternative that enforces nonce validation.
• Restrict /wp-admin/ access by IP allowlist or VPN to reduce exposure of authenticated administrators to CSRF.
• Enforce Content Security Policy (CSP) headers that disallow inline scripts to blunt Stored XSS execution.
• Require administrators to use isolated browser profiles when managing WordPress to limit cross-site session abuse.

# Example CSP header to restrict inline script execution in WordPress admin
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"