CVE-2025-49354: CSRF in Recent Posts From Each Category

The CSRF vulnerability in Recent Posts From Each Category allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successful exploitation can lead to Stored Cross-Site Scripting (XSS). This means an attacker can inject malicious JavaScript code that is stored on the server and executed when other users view affected pages. The impact of this XSS can range from session hijacking and defacement of the website to the theft of sensitive user data, including cookies and authentication tokens. The attacker could potentially gain control of user accounts or even the entire WordPress site depending on the privileges of the affected user.

1. Reserved2025-06-04
2. Published2025-12-31
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-49354 is to upgrade to a patched version of the Recent Posts From Each Category plugin as soon as it becomes available. Until a patch is released, consider disabling the plugin entirely to prevent exploitation. As a temporary workaround, implement strict Content Security Policy (CSP) headers to limit the execution of inline scripts and external resources. Additionally, enforce strong user authentication and regularly audit user permissions to minimize the potential impact of a successful attack. Monitor web application firewalls (WAFs) for suspicious CSRF requests targeting the plugin's endpoints.

Active installs

50

Plugin rating