CVE-2025-28883 in WP Compare Tables Plugin
Summary
by MITRE • 03/11/2025
Cross-Site Request Forgery (CSRF) vulnerability in Martin WP Compare Tables allows Stored XSS. This issue affects WP Compare Tables: from n/a through 1.0.5.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/12/2025
This Cross-Site Request Forgery vulnerability in the Martin WP Compare Tables plugin represents a critical security flaw that enables attackers to execute malicious scripts through manipulated requests. The vulnerability exists within the plugin's handling of user input and request processing mechanisms, creating an environment where malicious actors can craft forged requests that appear legitimate to the WordPress system. The specific version range from n/a through 1.0.5 indicates that all versions within this spectrum are potentially compromised, suggesting a widespread impact across multiple plugin releases. This type of vulnerability falls under CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in web applications. The ATT&CK framework categorizes this under T1566.001, which involves the exploitation of vulnerabilities to conduct phishing attacks through crafted web requests.
The technical implementation of this vulnerability allows for Stored XSS attacks, meaning that malicious script code injected through the CSRF vector can be permanently stored on the server and subsequently executed whenever affected pages are accessed. This creates a persistent threat where users who visit pages containing the malicious content become victims of the stored script execution. The plugin's lack of proper CSRF token validation and input sanitization mechanisms enables attackers to manipulate the plugin's functionality without proper authorization. When users with administrative privileges interact with the affected plugin, their sessions become vulnerable to manipulation, potentially allowing attackers to perform unauthorized actions on their behalf. The stored nature of the XSS payload means that the malicious code remains active even after the initial attack, creating a long-term security risk for all users who encounter the compromised content.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable full account compromise and unauthorized administrative access to WordPress installations. Attackers can leverage this vulnerability to inject malicious scripts that steal session cookies, redirect users to phishing sites, or manipulate the plugin's functionality to perform unauthorized modifications. The persistence of stored XSS makes this particularly dangerous as it can affect multiple users over extended periods, with the malicious code executing automatically whenever affected pages are loaded. This vulnerability creates a significant risk for WordPress administrators who may not immediately detect the compromise, as the malicious scripts can operate silently in the background. The vulnerability also impacts the overall security posture of WordPress installations, as it demonstrates how seemingly minor plugin flaws can create substantial attack vectors.
Mitigation strategies should focus on immediate plugin updates to versions that address the CSRF validation and input sanitization issues. Organizations should implement comprehensive security monitoring to detect unusual patterns in plugin usage and user behavior that might indicate exploitation attempts. The implementation of Content Security Policy headers can provide additional protection against XSS execution, while regular security audits of installed plugins should include verification of CSRF token implementation. Network-based intrusion detection systems should be configured to monitor for suspicious request patterns that might indicate CSRF attack attempts. Additionally, administrators should enforce strict input validation and implement proper session management practices to reduce the potential impact of any successful exploitation attempts. The vulnerability highlights the importance of maintaining up-to-date security practices and the necessity of thorough security testing for all web application components, particularly those that handle user-generated content or administrative functions.