CVE-2025-23600 Overview
CVE-2025-23600 is a reflected cross-site scripting (XSS) vulnerability in the Send to a Friend Addon (send-booking-invites-to-friends) WordPress plugin developed by pinal.shah. The plugin fails to properly neutralize user-supplied input during web page generation, allowing attackers to inject malicious JavaScript that executes in a victim's browser. The flaw affects all plugin versions up to and including 1.4.1. Exploitation requires user interaction, typically by tricking an authenticated user into clicking a crafted link. The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions performed on behalf of the targeted user.
Affected Products
- pinal.shah Send to a Friend Addon (send-booking-invites-to-friends) plugin for WordPress
- All versions from initial release through 1.4.1
- WordPress sites using the Send to a Friend Addon for booking invite distribution
Discovery Timeline
- 2025-03-03 - CVE-2025-23600 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-23600
Vulnerability Analysis
The vulnerability stems from improper neutralization of input during web page generation in the Send to a Friend Addon plugin. User-controlled parameters are reflected back into the HTTP response without adequate output encoding or input sanitization. An attacker constructs a URL containing JavaScript payload in a vulnerable parameter and delivers it to a victim through phishing, social engineering, or a malicious referrer.
When the victim follows the crafted link, the plugin returns a page that includes the unsanitized payload. The browser then interprets and executes the injected script in the context of the affected WordPress site. The scope is marked as changed, indicating the injected script can affect resources beyond the vulnerable component, such as the parent WordPress session.
Root Cause
The root cause is the absence of proper output encoding when reflecting request parameters into HTML responses. The plugin does not apply WordPress sanitization functions such as esc_html(), esc_attr(), or wp_kses() to user-supplied values before rendering them. This allows arbitrary HTML and JavaScript to be embedded in the response stream.
Attack Vector
The attack is delivered over the network and requires user interaction. An attacker hosts or distributes a crafted URL targeting a vulnerable endpoint of the plugin. When an authenticated administrator or site visitor clicks the link, the injected payload executes with the privileges of that user. Capabilities available to the attacker include exfiltrating session cookies, modifying page content, initiating CSRF actions against the WordPress admin interface, and redirecting users to attacker-controlled infrastructure.
No verified public proof-of-concept has been released. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-23600
Indicators of Compromise
- HTTP requests to send-booking-invites-to-friends plugin endpoints containing <script>, javascript:, onerror=, or onload= substrings in query parameters
- Unexpected outbound connections from administrator browsers to unfamiliar domains shortly after accessing the WordPress admin area
- New or unexpected WordPress administrator accounts, modified user roles, or altered plugin and theme files
Detection Strategies
- Monitor web server access logs for URL-encoded payloads such as %3Cscript%3E, %3Cimg, or %22%3E%3C targeting the vulnerable plugin path
- Deploy a Web Application Firewall (WAF) rule set that flags reflected XSS patterns on WordPress plugin endpoints
- Review browser console errors and Content Security Policy (CSP) violation reports from authenticated administrator sessions
Monitoring Recommendations
- Audit installed WordPress plugins for send-booking-invites-to-friends and confirm the version is greater than 1.4.1
- Track admin user activity logs for unexpected role changes, password resets, or plugin modifications
- Enable file integrity monitoring on wp-content/plugins/ and core WordPress files to detect unauthorized modifications
How to Mitigate CVE-2025-23600
Immediate Actions Required
- Deactivate and remove the Send to a Friend Addon plugin until a patched version above 1.4.1 is confirmed available from the vendor
- Force a password reset for all WordPress administrator and editor accounts that may have been targeted via crafted links
- Invalidate active WordPress sessions by rotating authentication salts and keys in wp-config.php
Patch Information
At the time of publication, the advisory indicates the vulnerability affects all versions through 1.4.1 with no fixed version identified. Monitor the Patchstack Vulnerability Report and the official WordPress plugin repository for an updated release addressing CVE-2025-23600.
Workarounds
- Remove the plugin entirely if a booking invite feature is not required for site operations
- Deploy a WAF such as Wordfence, Patchstack, or Cloudflare with rules blocking reflected XSS payloads on the vulnerable endpoints
- Apply a strict Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to trusted origins
- Restrict access to WordPress admin areas via IP allowlisting or VPN to limit exposure of authenticated sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
