CVE-2025-28861: WP jQuery Persian Datepicker CSRF Flaw

CVE-2025-28861 Overview

CVE-2025-28861 is a Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in the WordPress plugin wpjqp-datepicker by bhzad. The flaw affects all versions of WP jQuery Persian Datepicker up to and including 0.1.0. An attacker can trick an authenticated administrator into submitting a forged request that persists malicious JavaScript within the site. The stored payload then executes in the browsers of subsequent visitors or administrators. The issue is tracked under CWE-352.

Critical Impact
A successful attack allows persistent JavaScript execution in the context of the WordPress site, enabling session theft, administrative account takeover, or redirection to attacker-controlled infrastructure.

Affected Products

bhzad WP jQuery Persian Datepicker (wpjqp-datepicker) plugin for WordPress
All versions from initial release through 0.1.0
WordPress sites where the vulnerable plugin is installed and active

Discovery Timeline

2025-03-11 - CVE-2025-28861 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28861

Vulnerability Analysis

The plugin exposes administrative functionality that changes plugin state or stored content without validating request authenticity. The handling routines accept POST parameters and persist them to the database without verifying a WordPress nonce or checking the request origin. Because the stored value is later rendered in an administrative or public context without adequate output encoding, injected JavaScript executes in the browser of the viewer. This combines two weaknesses into a single exploitation chain: missing CSRF protection and unsanitized storage of user-controlled content.

Root Cause

The root cause is the absence of anti-CSRF controls on state-changing endpoints in wpjqp-datepicker. WordPress plugins are expected to enforce request authenticity through wp_nonce_field() on forms and check_admin_referer() or wp_verify_nonce() on handlers. The affected plugin omits these controls and additionally fails to sanitize or escape stored input before rendering, producing the Stored XSS outcome described in the Patchstack advisory.

Attack Vector

Exploitation requires user interaction. An attacker hosts a malicious page containing an auto-submitting form or fetch request targeting the vulnerable plugin endpoint. When an authenticated WordPress administrator visits the attacker page, the browser submits the forged request using the administrator's active session. The payload is written to the plugin's stored settings and rendered later without encoding, executing arbitrary JavaScript in every browser that loads the affected view.

The vulnerability mechanism is described in the Patchstack WordPress Vulnerability Report. No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2025-28861

Indicators of Compromise

Unexpected <script> tags, event handlers, or encoded JavaScript stored in the plugin's WordPress option rows within wp_options.
Outbound requests from administrator browsers to unfamiliar third-party domains after loading plugin-managed pages.
New or unexpected WordPress administrator accounts created shortly after an admin session visited an external site.
Web server access logs showing POST requests to wpjqp-datepicker endpoints with an external Referer header.

Detection Strategies

Inspect plugin option values and post metadata for HTML or JavaScript content that should contain only date-format configuration.
Correlate WordPress admin-ajax.php and plugin settings POST requests with the originating Referer and Origin headers.
Deploy Content Security Policy (CSP) reporting to surface inline script execution originating from plugin-rendered views.

Monitoring Recommendations

Alert on modifications to plugin configuration options performed outside of expected administrator workflows.
Monitor for anomalous session activity following administrator visits to external sites, particularly cookie theft or privilege changes.
Track file integrity of installed plugins and ingest WordPress audit logs into a centralized SIEM for correlation.

How to Mitigate CVE-2025-28861

Immediate Actions Required

Deactivate and remove the wpjqp-datepicker plugin from all WordPress installations until a patched release is available.
Audit wp_options and plugin-managed content for injected scripts and remove any malicious values.
Rotate credentials and session tokens for all WordPress administrators who accessed the site while the plugin was active.

Patch Information

No vendor patch is referenced in the advisory. The vulnerability affects all versions through 0.1.0, and no fixed version has been published. Consult the Patchstack advisory for updates and replace the plugin with a maintained alternative.

Workarounds

Restrict /wp-admin/ access by IP allowlist at the web server or WAF layer to reduce CSRF exposure.
Deploy a WAF rule that blocks POST requests to plugin endpoints when the Referer header does not match the site origin.
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads.
Require administrators to use dedicated browser profiles or sessions with no exposure to untrusted sites.

bash

# Example NGINX rule enforcing same-origin Referer on plugin admin POSTs
location ~ ^/wp-admin/admin(-ajax|-post)\.php$ {
    if ($request_method = POST) {
        set $ref_ok 0;
        if ($http_referer ~* "^https?://example\.com/") { set $ref_ok 1; }
        if ($ref_ok = 0) { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}