CVE-2025-23895 - Vulnerability Details - OpenCVE

Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.This issue affects Add RSS: from n/a through <= 1.5.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Wordpress	Wordpress

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/pentest
https://patchstack.com/database/Wordpress/Plugin/add-rss/vulnerability/wordpress-add-rss-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve

History

Wed, 01 Apr 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description	Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS allows Stored XSS.This issue affects Add RSS: from n/a through 1.5.	Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.This issue affects Add RSS: from n/a through <= 1.5.
References	https://patchstack.com/database/wordpress/plugin/add-rss/vulnerability/wordpress-add-rss-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/add-rss/vulnerability/wordpress-add-rss-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Fri, 17 Jan 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 16 Jan 2025 20:30:00 +0000

Type	Values Removed	Values Added
Description		Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS allows Stored XSS.This issue affects Add RSS: from n/a through 1.5.
Title		WordPress Add RSS plugin <= 1.5 - CSRF to Stored XSS vulnerability
Weaknesses		CWE-352
References		https://patchstack.com/database/wordpress/plugin/add-rss/vulnerability/wordpress-add-rss-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2025-01-16T20:07:37.944Z

Updated: 2026-04-01T15:43:34.309Z

Reserved: 2025-01-16T11:31:51.930Z

Link: CVE-2025-23895

Vulnrichment

Updated: 2025-01-17T17:16:46.999Z

NVD

Status : Awaiting Analysis

Published: 2025-01-16T21:15:30.967

Modified: 2026-04-01T17:17:21.833

Link: CVE-2025-23895

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-23895", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-01-16T11:31:51.930Z", "datePublished": "2025-01-16T20:07:37.944Z", "dateUpdated": "2026-04-01T15:43:34.309Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "add-rss", "product": "Add RSS", "vendor": "Dan Cameron", "versions": [{"lessThanOrEqual": "1.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "SOPROBRO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:33:42.234Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.<p>This issue affects Add RSS: from n/a through <= 1.5.</p>"}], "value": "Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.This issue affects Add RSS: from n/a through <= 1.5."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T15:43:34.309Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/add-rss/vulnerability/wordpress-add-rss-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve"}], "title": "WordPress Add RSS plugin <= 1.5 - CSRF to Stored XSS vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-17T17:16:45.739487Z", "id": "CVE-2025-23895", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-17T19:01:40.673Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23895", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-17T17:16:45.739487Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-17T17:16:46.999Z"}}], "cna": {"title": "WordPress Add RSS plugin <= 1.5 - CSRF to Stored XSS vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "SOPROBRO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "affected": [{"vendor": "Dan Cameron", "product": "Add RSS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.5"}], "packageName": "add-rss", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:33:42.234Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/add-rss/vulnerability/wordpress-add-rss-plugin-1-5-csrf-to-stored-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.This issue affects Add RSS: from n/a through <= 1.5.", "supportingMedia": [{"type": "text/html", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.<p>This issue affects Add RSS: from n/a through <= 1.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T15:43:34.309Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23895", "state": "PUBLISHED", "dateUpdated": "2026-04-01T15:43:34.309Z", "dateReserved": "2025-01-16T11:31:51.930Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-01-16T20:07:37.944Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}