CVE-2025-28900: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress TabGarb Pro plugin that allows for Stored Cross-Site Scripting (XSS). The vulnerability affects TabGarb Pro versions up to 2.6, with no official fix currently available. The issue was reported on February 24, 2025, and publicly disclosed on March 11, 2025 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High), with the following vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and allows unauthenticated attackers to potentially execute unwanted actions under the context of privileged users (NVD, Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. Additionally, the combination of CSRF with Stored XSS capabilities increases the potential impact on affected systems (Patchstack).

Currently, there is no official fix available for this vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).