CVE-2025-0862: SuperSaaS WordPress Plugin XSS Vulnerability

CVE-2025-0862 Overview

CVE-2025-0862 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the SuperSaaS – online appointment scheduling plugin for WordPress. The flaw affects all versions up to and including 2.1.12. It stems from insufficient input sanitization and output escaping on the after parameter within the plugin's shortcode handler. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes whenever a visitor renders the affected page in a Chromium-based browser such as Chrome, Edge, or Brave.

Critical Impact
Authenticated contributors can persist JavaScript into published WordPress pages, enabling session theft, forced redirects, and administrative action hijacking against visitors using Chromium browsers.

Affected Products

SuperSaaS – online appointment scheduling plugin for WordPress, versions ≤ 2.1.12
WordPress sites permitting Contributor-level or higher accounts with the plugin installed
Content rendered to Chromium-based browsers (Chrome, Edge, Brave)

Discovery Timeline

2025-02-11 - CVE-2025-0862 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0862

Vulnerability Analysis

The SuperSaaS plugin exposes a shortcode that accepts user-supplied attributes, including an after parameter. The shortcode handler passes the attribute value into rendered HTML output without applying proper sanitization or context-aware output escaping. As a result, a Contributor who edits a post or page can supply a crafted shortcode attribute containing script content, which the plugin then stores as part of the post and later reflects into the DOM.

Because the payload is stored server-side within post content, every visitor who loads the affected page triggers execution. Exploitation is scoped to Chromium-based browsers due to their handling of certain HTML parsing conditions surfaced by the injection sink, while Firefox and Safari do not appear to execute the payload under the same conditions. The scope change reflected in the vulnerability metrics indicates the injected script executes in the security context of any authenticated viewer, including administrators who preview or moderate the injected content.

Root Cause

The root cause is a missing sanitization and escaping step in the plugin's shortcode implementation. The after attribute value flows from shortcode parsing directly into HTML output. Neither esc_attr(), esc_html(), nor wp_kses() is applied before rendering, permitting arbitrary tag and script injection.

Attack Vector

An authenticated attacker holding at least Contributor privileges creates or edits a post containing the plugin's shortcode with a malicious after attribute value. WordPress stores the post, and the stored payload executes when any visitor using a Chromium browser loads the page. The attacker can hijack sessions, exfiltrate cookies not flagged HttpOnly, perform actions on behalf of higher-privileged users, or pivot into administrative functionality through forged requests.

// No verified exploit code is published. Technical detail is available at:
// https://plugins.trac.wordpress.org/browser/supersaas-appointment-scheduling/tags/2.1.12/includes/shortcode.php

Detection Methods for CVE-2025-0862

Indicators of Compromise

Post or page content containing SuperSaaS shortcodes with after attribute values that include <script>, onerror=, onload=, or javascript: sequences.
Unexpected outbound requests from browser sessions to attacker-controlled domains originating on pages that render SuperSaaS booking widgets.
Contributor or Author accounts modifying published pages that contain the plugin's shortcode without a legitimate editorial reason.

Detection Strategies

Query the wp_posts table for shortcode occurrences containing HTML entities or angle brackets inside the after attribute value.
Enable and review WordPress audit logs for post edits performed by low-privilege roles that introduce the SuperSaaS shortcode.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions originating from post content.

Monitoring Recommendations

Alert on new or modified posts introduced by Contributor-level accounts that include the SuperSaaS shortcode.
Monitor web server access logs for spikes in traffic to pages containing the plugin's booking widgets, especially with referrers from admin URLs.
Correlate browser telemetry from Chrome, Edge, and Brave sessions with WordPress publishing events to identify script execution windows.

How to Mitigate CVE-2025-0862

Immediate Actions Required

Upgrade the SuperSaaS – online appointment scheduling plugin to a version newer than 2.1.12, as delivered in WordPress plugin changeset #3235242.
Audit existing posts and pages for SuperSaaS shortcodes containing suspicious after attribute values and remove any injected markup.
Review the Contributor, Author, and Editor account list and revoke unnecessary content-editing privileges.

Patch Information

The vendor addressed the issue in the release following version 2.1.12. Refer to the Wordfence Vulnerability Report and the WordPress Changeset #3235242 for the fix that adds proper escaping to the shortcode attributes. Site operators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Temporarily deactivate the SuperSaaS plugin until the patched version is deployed.
Restrict Contributor and Author roles from using the plugin's shortcodes by removing shortcode registration for non-privileged roles.
Enforce a strict Content Security Policy that disallows inline scripts on public site pages to reduce impact of stored payloads.

bash

# Update the plugin using WP-CLI
wp plugin update supersaas-appointment-scheduling

# Or temporarily deactivate until patched
wp plugin deactivate supersaas-appointment-scheduling