CVE-2025-26569 HIGH

CVE-2025-26569: WordPress Post Thumbs Plugin <= 1.5 - CSRF to Stored XSS vulnerability

Vendor Callmeforsox
Product Post Thumbs
Weakness CWE-352 · CSRF
Published February 13, 2025
Last update May 27, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Callmeforsox Post Thumbs allows Stored XSS. This issue affects Post Thumbs: from n/a through 1.5.

Key dates

02Disclosure timeline

February 13, 2025 CVE published
May 27, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-25075 WordPress Show notice or message on admin area plugin <= 2.0 - CSRF to Stored XSS vulnerability CVE-2017-20088 Atahualpa Theme cross-site request forgery CVE-2026-3499 Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce 13.4.6 - 13.5.2.1 - Cross-Site Request Forgery to Multiple Administrative Actions CVE-2025-48304 WordPress Google XML News Sitemap plugin plugin <= 0.02 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability CVE-2025-28863 WordPress Delete Original Image plugin <= 0.4 - Cross Site Request Forgery (CSRF) vulnerability