CVE-2025-58859 Overview
CVE-2025-58859 is a Cross-Site Request Forgery (CSRF) vulnerability in the David Merinas Add to Feedly WordPress plugin. The flaw affects all versions up to and including 1.2.11. An attacker can chain the CSRF weakness with stored Cross-Site Scripting (XSS) to inject persistent malicious JavaScript into plugin-controlled output. Exploitation requires tricking an authenticated administrator into visiting a crafted page or clicking a malicious link. The vulnerability is tracked under CWE-352 and analyzed in the Patchstack advisory.
Critical Impact
A successful attack stores attacker-controlled JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, content tampering, and further account compromise.
Affected Products
- David Merinas Add to Feedly WordPress plugin
- Versions from n/a through <= 1.2.11
- WordPress sites with the add-to-feedly plugin installed and active
Discovery Timeline
- 2025-09-05 - CVE-2025-58859 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-58859
Vulnerability Analysis
The Add to Feedly plugin fails to validate request authenticity on state-changing administrative actions. WordPress provides nonces through wp_nonce_field() and check_admin_referer() to bind requests to a specific user session. The plugin omits or improperly validates these tokens on settings handlers. An attacker hosts a malicious page that submits a forged POST request to the plugin's admin endpoint. When a logged-in administrator visits the page, the browser attaches the session cookie and the request executes with administrative privileges.
The plugin also stores the submitted settings without sufficient output encoding. The forged request injects JavaScript payloads into plugin settings fields. The stored payload then renders inside pages the plugin controls, producing stored XSS. The chain elevates a passive CSRF flaw into persistent script execution in privileged contexts.
Root Cause
The root cause is missing or insufficient CSRF protection on administrative request handlers, combined with inadequate input sanitization and output escaping on plugin settings. The plugin trusts authenticated session cookies as proof of intent, which is the defining condition for CWE-352.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker crafts an HTML page containing an auto-submitting form or fetch() request targeting the vulnerable plugin endpoint. The attacker lures an authenticated WordPress administrator to the page through phishing, a malicious comment link, or a compromised third-party site. The forged request writes attacker-controlled JavaScript into plugin options. The payload subsequently executes whenever the affected plugin output renders, including front-end pages and admin screens. Refer to the Patchstack analysis for additional technical context.
Detection Methods for CVE-2025-58859
Indicators of Compromise
- Unexpected modifications to wp_options rows associated with the add-to-feedly plugin
- Presence of <script> tags, onerror=, or javascript: URIs inside plugin settings stored in the database
- Outbound requests from visitor browsers to unfamiliar domains shortly after pages render the plugin output
- Administrator account activity originating from unusual Referer headers pointing to external sites
Detection Strategies
- Inspect WordPress access logs for POST requests to wp-admin plugin endpoints with external Referer headers
- Query the database for plugin option values containing HTML or script-like content
- Monitor file integrity and option-table changes through a WordPress security plugin or audit log
- Deploy Content Security Policy (CSP) violation reporting to surface unexpected inline script execution
Monitoring Recommendations
- Alert on administrative POST requests lacking same-origin Referer values
- Track plugin version inventory and flag any host still running Add to Feedly <= 1.2.11
- Forward WordPress and web server logs to a centralized analytics platform for correlation across sessions
How to Mitigate CVE-2025-58859
Immediate Actions Required
- Deactivate the Add to Feedly plugin on all WordPress sites until a patched release is confirmed
- Audit plugin settings stored in wp_options and remove any HTML or JavaScript content
- Force a password reset and session invalidation for all administrator accounts
- Review recent administrative actions for unauthorized configuration changes
Patch Information
At the time of publication, the Patchstack advisory lists no fixed version. Versions through 1.2.11 are affected. Monitor the plugin's WordPress.org page and the vendor advisory for an updated release, and apply it as soon as it becomes available.
Workarounds
- Remove the plugin entirely and replace it with an actively maintained alternative if no patch is available
- Restrict /wp-admin/ access by IP address through web server rules or a Web Application Firewall (WAF)
- Enforce a strict Content Security Policy that disallows inline scripts to limit stored XSS impact
- Require administrators to use a separate browser profile for WordPress administration to reduce CSRF exposure
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
