CVE-2025-12368 Overview
The Sermon Manager plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.30.0. The flaw resides in the sermon-views shortcode, which fails to sanitize user-supplied attributes and does not escape output rendered back to the page. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who loads the affected page. The vulnerability is tracked as CWE-79 and requires low privileges without user interaction.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against administrators and site visitors, enabling session theft, forced actions, and content defacement.
Affected Products
- Sermon Manager for WordPress plugin, all versions through 2.30.0
- WordPress installations that expose Contributor or higher roles
- Sites rendering the sermon-views shortcode on public-facing pages
Discovery Timeline
- 2025-12-05 - CVE-2025-12368 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12368
Vulnerability Analysis
The vulnerability is a stored XSS flaw in the Sermon Manager plugin's sermon-views shortcode handler. The shortcode accepts attributes supplied by the content author and reflects them into the rendered HTML without applying WordPress sanitization functions such as sanitize_text_field() or output escaping through esc_attr() and esc_html().
Because the payload is persisted in post content, execution occurs every time a user renders the page containing the malicious shortcode. Contributors, who normally cannot publish, can still save drafts and submit posts for review, giving editors and administrators exposure to the payload. The scope change indicated by the vulnerability metrics reflects impact reaching users beyond the attacker's own session context.
Root Cause
The root cause is insufficient input sanitization and output escaping on user-controlled shortcode attributes processed by entry-views.php. The plugin passes attribute values directly into the HTML response without neutralizing script-capable characters. Reference the vendor source at WordPress Plugin Code Snippet for the affected function.
Attack Vector
An attacker authenticates to WordPress with Contributor privileges or higher. The attacker creates or edits a post that includes the sermon-views shortcode with an attribute containing a JavaScript payload. When an administrator previews the submission or any visitor loads the published page, the browser executes the injected script under the site's origin. Successful exploitation can steal session cookies, perform actions as the viewing user, or pivot to administrative account takeover.
No verified proof-of-concept code is published. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-12368
Indicators of Compromise
- Post content or postmeta rows containing [sermon-views shortcodes with attributes holding <script>, onerror=, onload=, or javascript: substrings.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing plugin-rendered pages.
- New administrative accounts, plugin installations, or option changes originating from an editor or administrator session that recently viewed contributor-submitted content.
Detection Strategies
- Query the wp_posts table for post_content values matching the sermon-views shortcode combined with HTML event handlers or script tags.
- Review WordPress audit logs for Contributor accounts that recently submitted or edited posts containing the shortcode.
- Inspect HTTP responses from pages using the shortcode for reflected attribute values that were not passed through escaping helpers.
Monitoring Recommendations
- Alert on creation or modification of posts containing the sermon-views shortcode by non-administrator roles.
- Monitor for privilege escalation events, role changes, and plugin or theme installations performed shortly after administrator sessions render contributor content.
- Baseline outbound traffic from administrative browser sessions and flag connections to previously unseen domains.
How to Mitigate CVE-2025-12368
Immediate Actions Required
- Upgrade Sermon Manager for WordPress to a version released after 2.30.0 that addresses the shortcode sanitization defect once available from the WordPress Sermon Manager Plugin page.
- Audit existing posts and drafts for the sermon-views shortcode and remove or sanitize any attribute containing HTML or script content.
- Rotate credentials and invalidate active sessions for administrators who may have rendered malicious contributor submissions.
Patch Information
At the time of publication, the vulnerability affects all versions up to and including 2.30.0. Site operators should track the plugin's changelog on the WordPress Sermon Manager Plugin page and apply the vendor's fixed release as soon as it is available. Refer to the Wordfence Vulnerability Report for updated patch tracking.
Workarounds
- Restrict Contributor and Author role assignments to trusted users until a patched release is installed.
- Deactivate the Sermon Manager plugin on sites that do not actively rely on it, or remove the sermon-views shortcode from public templates.
- Deploy a web application firewall rule that blocks requests containing sermon-views shortcode attributes with script tags or JavaScript event handlers.
- Enforce a Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
