CVE-2025-28960: Evangelische Termine XSS Vulnerability

CVE-2025-28960 Overview

CVE-2025-28960 is a reflected Cross-Site Scripting (XSS) vulnerability affecting the regibaer Evangelische Termine (evangtermine) WordPress plugin. The flaw stems from improper neutralization of user input during web page generation, classified as [CWE-79]. All plugin versions up to and including 3.3 are affected. Attackers can craft malicious URLs that execute arbitrary JavaScript in the browser of any user who clicks the link. Because the scope is changed, the script runs in the context of the vulnerable WordPress site and can access session data, perform actions on behalf of authenticated users, or redirect victims to attacker-controlled infrastructure.

Critical Impact
A successful attack allows execution of arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, and unauthorized administrative actions on affected WordPress sites.

Affected Products

regibaer Evangelische Termine (evangtermine) WordPress plugin
All versions from n/a through <= 3.3
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2025-06-27 - CVE-2025-28960 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28960

Vulnerability Analysis

The vulnerability is a reflected XSS issue in the evangtermine plugin, which is used to display Protestant church event calendars on WordPress sites. User-supplied input reaches the page rendering layer without proper sanitization or output encoding. An attacker injects JavaScript payloads into a request parameter, and the plugin reflects the unsanitized value back into the generated HTML response.

Exploitation requires user interaction. A victim must click a crafted link or visit an attacker-controlled page that triggers the request. Because the issue affects a publicly accessible plugin endpoint, no authentication is required to deliver the payload. The vulnerability carries a changed scope, meaning the injected script can affect resources beyond the vulnerable component itself, such as the broader WordPress session context.

Root Cause

The root cause is missing input validation and output encoding in the plugin's request handling code. Parameters supplied via HTTP requests are concatenated into HTML output without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This allows angle brackets, quotes, and script tags to survive into the rendered DOM.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL containing a JavaScript payload in a vulnerable parameter, then delivers it through phishing, forum posts, or malicious advertising. When a victim loads the URL, the plugin reflects the payload into the response HTML. The browser then executes the script under the origin of the affected WordPress site, granting access to cookies, local storage, and the authenticated session if the victim is logged in. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-28960

Indicators of Compromise

HTTP requests to evangtermine plugin endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: strings in query parameters.
Web server access logs showing unusually long query strings or HTML entity sequences targeting plugin URLs.
Outbound browser requests from site visitors to unfamiliar third-party domains immediately after visiting plugin-rendered pages.

Detection Strategies

Inspect web server and WAF logs for reflected XSS payload patterns directed at WordPress plugin paths containing evangtermine.
Deploy signatures that flag GET parameters containing HTML tag delimiters, event handler attributes, or JavaScript pseudo-protocols.
Correlate suspicious referrer chains with subsequent administrator account anomalies such as unexpected logins or content changes.

Monitoring Recommendations

Enable verbose access logging on WordPress sites and forward logs to a centralized analytics platform for query-string inspection.
Monitor administrator session activity for actions originating immediately after clicks on external links.
Track installed plugin versions across the WordPress estate to identify hosts still running evangtermine3.3 or earlier.

How to Mitigate CVE-2025-28960

Immediate Actions Required

Identify all WordPress instances with the evangtermine plugin installed and confirm the installed version.
Deactivate the plugin until a patched release is confirmed and applied.
Audit administrator and editor accounts for unauthorized changes, new users, or modified content.
Force password rotation and session invalidation for privileged WordPress accounts on affected sites.

Patch Information

At the time of the NVD entry, the vulnerability affects all versions through 3.3. Consult the Patchstack Vulnerability Report for the latest fixed version information and upgrade guidance. Update the plugin to the vendor-released patched version as soon as it becomes available.

Workarounds

Deploy a Web Application Firewall (WAF) rule blocking HTTP requests to plugin endpoints that contain HTML tag characters or JavaScript event handlers in parameters.
Apply a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to the affected plugin endpoints via server-level rules until a patched version is installed.

bash

# Example NGINX rule to block common reflected XSS payloads against the plugin
location ~* /wp-content/plugins/evangtermine/ {
    if ($args ~* "(<|%3C)\s*script|onerror=|onload=|javascript:") {
        return 403;
    }
}