{"id":"CVE-2025-28894","aliases":["EUVD-2025-7853","GHSA-xcpx-xw8r-x8rf"],"status":"published","title":"WordPress List of Posts from each Category plugin for WordPress plugin \u003c= 2.0 - CSRF to Stored XSS vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through \u003c= 2.0.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00151,"percentile":0.04257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2025-03-11T21:00:48Z","modified":"2026-06-17T09:04:50Z","products":[{"vendor":"frucomerci","product":"list of posts from each category plugin for wordpress"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/list-posts-by-category/vulnerability/wordpress-list-of-posts-from-each-category-plugin-for-wordpress-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-28894"},{"url":"https://patchstack.com/database/wordpress/plugin/list-posts-by-category/vulnerability/wordpress-list-of-posts-from-each-category-plugin-for-wordpress-plugin-2-0-csrf-to-stored-xss-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-xcpx-xw8r-x8rf"}],"sources":{"cve":[{"id":"CVE-2025-28894","title":"WordPress List of Posts from each Category plugin for WordPress plugin \u003c= 2.0 - CSRF to Stored XSS vulnerability","description":"Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through \u003c= 2.0.","status":"published","published":"2025-03-11T21:00:48.897Z","modified":"2026-04-28T16:11:50.179Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:50.176138Z"}],"euvd":[{"id":"EUVD-2025-7853","description":"Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through \u003c= 2.0.","status":"published","published":"2025-03-11T21:00:48Z","modified":"2026-04-28T16:11:50Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:05:49.30843Z"}],"ghsa":[{"id":"GHSA-xcpx-xw8r-x8rf","title":"Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category...","description":"Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress allows Stored XSS. This issue affects List of Posts from each Category plugin for WordPress: from n/a through 2.0.","status":"published","published":"2025-03-11T21:30:39Z","modified":"2025-03-11T21:30:48Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:00:13.856555Z"}],"nvd":[{"id":"CVE-2025-28894","description":"Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through \u003c= 2.0.","status":"published","published":"2025-03-11T21:15:46.723Z","modified":"2026-06-17T09:04:50.36Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:53.93104Z"}]}}