CVE-2025-39515: Attendance Manager Stored XSS Vulnerability

CVE-2025-39515 Overview

CVE-2025-39515 is a stored cross-site scripting (XSS) vulnerability in the tnomi Attendance Manager plugin for WordPress. The flaw affects all versions of attendance-manager up to and including 0.6.2. Attackers with low-privilege authenticated access can inject malicious script content that persists in the plugin's stored data. When another user renders the affected page, the browser executes the attacker-controlled JavaScript in the victim's session context. The issue is tracked under CWE-79 for improper neutralization of input during web page generation.

Critical Impact

Stored XSS allows an authenticated attacker to run arbitrary JavaScript in the browser of any user viewing the compromised page, enabling session theft, forced actions, and content manipulation across the WordPress site.

Affected Products

• tnomi Attendance Manager WordPress plugin (attendance-manager)
• All versions from initial release through 0.6.2
• WordPress sites with the plugin installed and active

Discovery Timeline

• 2025-04-16 - CVE-2025-39515 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39515

Vulnerability Analysis

The Attendance Manager plugin accepts user-supplied input and stores it without proper output encoding or sanitization. When the stored data is later rendered inside a WordPress page or administrative view, the input is written directly into the HTML response. A browser interprets embedded <script> payloads or event handlers as executable code rather than inert text.

Because the payload persists in the database, every subsequent visitor to the affected view triggers execution. This distinguishes the flaw from reflected XSS and increases blast radius across administrators and end users. Exploitation requires an authenticated session with low privileges and some user interaction to view the malicious content.

The scope change indicated in the CVSS vector reflects that a payload injected under one privilege boundary can affect resources under another, such as an administrator loading a page populated by a lower-privileged contributor.

Root Cause

The root cause is missing input neutralization and missing output escaping in the plugin's page-generation logic. Standard WordPress helpers such as sanitize_text_field(), wp_kses_post(), and esc_html() were not applied to attacker-controlled fields before rendering.

Attack Vector

An authenticated attacker submits a crafted payload through a plugin form or field that stores attendance-related data. The payload is written to the database intact. When a privileged user opens the corresponding view, the browser parses the injected script and executes it in the site's origin. See the Patchstack XSS Vulnerability Report for advisory details.

Detection Methods for CVE-2025-39515

Indicators of Compromise

• Attendance Manager records containing HTML tags, <script> fragments, javascript: URIs, or event handlers such as onerror= and onload=.
• Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening plugin pages.
• New or modified WordPress administrator accounts created through session or cookie theft following plugin page views.

Detection Strategies

• Query the WordPress database tables used by attendance-manager for stored values matching XSS payload signatures.
• Review web server access logs for POST requests to plugin endpoints containing URL-encoded <, >, or script tokens.
• Inspect plugin-rendered pages in a sandboxed browser with Content Security Policy (CSP) violation reporting enabled.

Monitoring Recommendations

• Enable a WordPress activity log to capture creation and modification events on Attendance Manager records.
• Forward web server and WordPress audit logs to a centralized SIEM for correlation with authentication anomalies.
• Alert on administrator sessions that generate new privileged actions immediately after loading a plugin view.

How to Mitigate CVE-2025-39515

Immediate Actions Required

• Deactivate the Attendance Manager plugin on any WordPress site running version 0.6.2 or earlier until a patched release is available.
• Audit existing attendance records and remove any entries containing HTML or script content.
• Rotate credentials and invalidate active sessions for administrators who accessed plugin pages during the exposure window.

Patch Information

At the time of the NVD entry, the advisory lists all versions through 0.6.2 as affected and does not identify a fixed version. Monitor the Patchstack advisory and the plugin's WordPress.org listing for a release that addresses the flaw.

Workarounds

• Restrict access to the plugin's data-entry forms to trusted users only using WordPress role management.
• Deploy a web application firewall (WAF) rule that blocks HTML and script tokens in requests targeting attendance-manager endpoints.
• Enforce a strict Content Security Policy that disallows inline scripts to reduce exploitability of any stored payloads.

# Configuration example: temporary CSP header via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"