Cross-Site Request Forgery in Add to Feedly by David Merina
CVE-2025-58859

7.1HIGH

Key Information:

Vendor

WordPress
Status
Add To Feedly
Vendor
CVE Published:
5 September 2025

What is CVE-2025-58859?

A Cross-Site Request Forgery (CSRF) vulnerability in the Add to Feedly plugin developed by David Merina allows attackers to perform unauthorized actions on behalf of an authenticated user. This capability can lead to a Stored Cross-Site Scripting (XSS) attack, wherein malicious scripts are injected and executed on users’ browsers when the affected plugin is utilized. Users running versions from n/a through 1.2.11 should take immediate action to secure their installations.

Affected Version(s)

Add to Feedly <= 1.2.11

References

https://patchstack.com/database/wordpress/plugin/add-to-f...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.
CVE-2025-58859 : Cross-Site Request Forgery in Add to Feedly by David Merina