CVE-2025-23636: My Favorite Car Plugin XSS Vulnerability

CVE-2025-23636 Overview

CVE-2025-23636 is a reflected cross-site scripting (XSS) vulnerability in the My Favorite Car WordPress plugin by Dimitar A. The flaw stems from improper neutralization of user input during web page generation [CWE-79]. Affected versions include My Favorite Car plugin up to and including version 1.0. An attacker can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser within the context of the vulnerable site. The vulnerability requires user interaction and changes the security scope, allowing the attacker to impact resources beyond the vulnerable component.

Critical Impact

Successful exploitation enables session hijacking, credential theft, and unauthorized actions performed as the victim user in the WordPress site context.

Affected Products

• WordPress plugin: My Favorite Car (my-favorite-cars)
• Versions affected: from initial release through 1.0
• Vendor: Dimitar A.

Discovery Timeline

• 2025-01-23 - CVE-2025-23636 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23636

Vulnerability Analysis

The My Favorite Car plugin fails to sanitize and escape user-supplied input before reflecting it into rendered HTML responses. This results in a reflected XSS condition classified under [CWE-79]. An attacker crafts a request containing JavaScript payloads in vulnerable parameters. When a victim loads the attacker-supplied URL, the browser parses and executes the injected script in the trust context of the affected WordPress site.

The reflected nature of the flaw requires user interaction, typically through phishing or a malicious link embedded in a third-party site. No authentication is required to trigger the vulnerability. Because the issue changes scope, the executed script can affect data and sessions beyond the plugin itself, including WordPress authentication cookies that are not flagged HttpOnly.

Root Cause

The root cause is missing output encoding and input validation in plugin code that echoes request parameters back into HTML responses. WordPress provides escaping functions such as esc_html(), esc_attr(), and wp_kses() to prevent this class of issue, but the plugin does not apply them consistently on reflected values up through version 1.0.

Attack Vector

The attack vector is network-based with low complexity and no privileges required, but user interaction is mandatory. An attacker delivers a crafted link to a target with administrative or authenticated access to the WordPress site. When the target visits the link, the injected payload executes, enabling cookie theft, session hijacking, content manipulation, or redirection to attacker-controlled resources.

Technical details and proof-of-concept information are documented in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-23636

Indicators of Compromise

• HTTP requests to WordPress endpoints associated with the my-favorite-cars plugin containing URL-encoded <script>, onerror=, onload=, or javascript: payloads.
• Referrer logs showing inbound traffic from external sites with suspicious query strings targeting plugin parameters.
• Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after clicking inbound links.

Detection Strategies

• Inspect web server access logs for query strings containing HTML or JavaScript metacharacters reaching plugin URLs.
• Deploy a web application firewall (WAF) rule set that flags reflected XSS payload signatures in GET and POST parameters.
• Use content security policy (CSP) violation reports to identify script execution attempts originating from untrusted sources.

Monitoring Recommendations

• Enable verbose access logging on the WordPress site and forward logs to a centralized analytics platform for query-string anomaly detection.
• Monitor administrator session activity for unusual API calls, content changes, or new user creation following link-click events.
• Track plugin inventory and version state across WordPress installations to identify systems running my-favorite-cars at version 1.0 or earlier.

How to Mitigate CVE-2025-23636

Immediate Actions Required

• Deactivate and remove the My Favorite Car plugin from any WordPress site running version 1.0 or earlier until a fixed release is confirmed.
• Force a logout of all administrator sessions and rotate authentication cookies and passwords for privileged accounts.
• Apply WAF virtual-patching rules that block reflected XSS payload patterns targeting plugin endpoints.

Patch Information

At the time of publication, the Patchstack advisory lists affected versions through 1.0 with no fixed version specified. Administrators should consult the Patchstack WordPress Vulnerability Report for the latest patch status and remove the plugin if no update is available.

Workarounds

• Restrict access to the WordPress administration interface using IP allowlisting at the web server or reverse proxy layer.
• Deploy a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins.
• Train administrators to avoid clicking unsolicited links that reference their WordPress site domain with unusual query parameters.

# Example: deactivate vulnerable plugin via WP-CLI
wp plugin deactivate my-favorite-cars
wp plugin delete my-favorite-cars