CVE-2025-23982: Fare Calculator Stored XSS Vulnerability

CVE-2025-23982 Overview

CVE-2025-23982 is a Missing Authorization vulnerability [CWE-862] affecting the Gopi krishnan Fare Calculator WordPress plugin. The flaw allows unauthenticated attackers to chain a Cross-Site Request Forgery (CSRF) condition with Stored Cross-Site Scripting (XSS). All versions of the fare-calculator plugin up to and including 1.1 are affected.

An attacker can craft a malicious request that, when triggered by a privileged user, injects persistent JavaScript into plugin-managed content. The injected payload executes in the browser context of any user who views the affected page, enabling session theft, administrative action abuse, and further client-side compromise.

Critical Impact
Successful exploitation enables attackers to plant persistent JavaScript that executes against site administrators and visitors, leading to account takeover and content tampering.

Affected Products

Gopi krishnan Fare Calculator plugin for WordPress
All fare-calculator versions from initial release through 1.1
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-01-27 - CVE-2025-23982 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23982

Vulnerability Analysis

The vulnerability stems from two compounding weaknesses in the Fare Calculator plugin. First, sensitive plugin actions lack proper capability or nonce verification, classifying the root cause as Missing Authorization [CWE-862]. Second, user-supplied input handled by these actions is stored without sanitization and later rendered in the browser without output encoding.

Because the affected endpoint does not validate the request origin, an attacker can trick an authenticated administrator into submitting a crafted request from an external page. The request writes attacker-controlled JavaScript into the plugin's stored data. The payload then fires whenever the affected fare-calculator content loads, producing a Stored XSS condition with persistent reach across all viewers.

The attack requires user interaction, but no prior authentication on the target site is needed by the attacker. The scope is changed because injected scripts execute in the context of the WordPress site, beyond the vulnerable plugin boundary.

Root Cause

The plugin fails to enforce authorization checks (capability checks and CSRF nonces) on state-changing handlers. Combined with absent input sanitization and output escaping, this lets unsanitized input persist in the database and execute as script content on rendering.

Attack Vector

The attack vector is network-based via a crafted HTML page or link. An attacker hosts a forged form that targets the plugin's vulnerable endpoint. When an authenticated administrator visits the attacker's page, the browser submits the request with valid session cookies, storing the XSS payload. The payload then executes for every subsequent visitor to the affected page.

No verified exploit code is publicly available. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-23982

Indicators of Compromise

Unexpected <script> tags, onerror/onload handlers, or obfuscated JavaScript stored in Fare Calculator plugin records
Outbound HTTP requests from administrator browsers to unknown domains after visiting plugin-managed pages
New or modified WordPress administrator accounts following admin sessions where the plugin was loaded
Referer headers in plugin update requests originating from external, untrusted domains

Detection Strategies

Inspect WordPress database tables associated with the fare-calculator plugin for HTML or JavaScript content in fields expected to contain plain text
Review web server access logs for POST requests to plugin endpoints lacking a matching prior GET from the WordPress admin dashboard
Deploy a web application firewall rule that flags requests to plugin handlers without a valid _wpnonce parameter

Monitoring Recommendations

Enable WordPress audit logging to capture changes to plugin settings and stored content
Monitor Content Security Policy (CSP) violation reports for inline-script blocks originating from plugin pages
Alert on creation of WordPress users with elevated roles outside of approved change windows

How to Mitigate CVE-2025-23982

Immediate Actions Required

Deactivate and remove the Fare Calculator plugin until a patched version is available, since the issue affects all releases through 1.1
Audit existing fare-calculator entries for injected script content and remove any unauthorized payloads
Force a password reset and session invalidation for all WordPress administrator accounts that interacted with the plugin
Apply a vendor patch immediately once released and verify the installed version exceeds 1.1

Patch Information

At the time of NVD publication, no fixed version above 1.1 is identified in the advisory. Track the Patchstack WordPress Vulnerability Report for vendor remediation status and apply updates as they become available.

Workarounds

Restrict access to /wp-admin/ by IP allow-listing to reduce CSRF exposure for administrator sessions
Deploy a WAF rule blocking POST requests to fare-calculator endpoints that lack a valid WordPress nonce parameter
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering plugin output
Require administrators to use a dedicated browser profile for WordPress administration to limit cross-site request exposure

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate fare-calculator
wp plugin delete fare-calculator