CVE-2025-46528 Overview
CVE-2025-46528 is a Cross-Site Request Forgery (CSRF) vulnerability in the Steve Availability Calendar WordPress plugin that enables Stored Cross-Site Scripting (XSS). The flaw affects all versions of the Availability Calendar plugin up to and including 0.2.4. An attacker can craft a malicious request that, when triggered by an authenticated administrator, injects persistent JavaScript into the plugin's stored data. The injected payload then executes in the browser of any user who views the affected page.
Critical Impact
Successful exploitation allows attackers to plant stored XSS payloads through forged administrator requests, leading to session theft, account takeover, and arbitrary actions within the WordPress admin context.
Affected Products
- Steve Availability Calendar plugin for WordPress
- All versions from initial release through 0.2.4
- WordPress installations with the plugin active and accessible to administrators
Discovery Timeline
- 2025-04-24 - CVE-2025-46528 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-46528
Vulnerability Analysis
The vulnerability chains two distinct weaknesses tracked under [CWE-352]: missing CSRF protection and insufficient output encoding. The plugin exposes state-changing endpoints that update calendar availability data without validating anti-CSRF tokens such as WordPress nonces. Attackers can host a malicious page that submits forged requests against the WordPress site. When an authenticated administrator visits the attacker-controlled page, their browser silently submits the request using the administrator's session cookies.
Because the plugin also fails to sanitize or escape the submitted values before storing and rendering them, the forged input persists as Stored XSS. Subsequent visits to the affected calendar pages execute the injected script in the victim's browser session.
Root Cause
The root cause is the absence of nonce verification on availability-update handlers combined with missing input sanitization on user-supplied calendar fields. WordPress provides wp_verify_nonce() and escaping helpers such as esc_html() and wp_kses_post(), but the vulnerable code paths do not invoke them. This allows untrusted input to flow directly into stored content.
Attack Vector
The attack is remote and requires user interaction. An attacker lures an authenticated WordPress administrator to a malicious page or a crafted link. The forged request executes under administrator privileges, and the injected payload is stored in the plugin's data. Any subsequent page render that includes the malicious content triggers script execution in the viewer's browser. Refer to the Patchstack WordPress Vulnerability Analysis for additional context.
Detection Methods for CVE-2025-46528
Indicators of Compromise
- Unexpected <script>, onerror=, or onload= strings stored within Availability Calendar database entries
- WordPress admin sessions originating from unusual referrers immediately before calendar data changes
- New or modified administrator accounts created shortly after a calendar edit
- Outbound requests from the WordPress server or admin browsers to unknown domains following a calendar view
Detection Strategies
- Inspect plugin tables and post meta for HTML or JavaScript tokens that should not appear in calendar text fields
- Review web server access logs for POST requests to plugin endpoints lacking a same-origin Referer or missing _wpnonce parameters
- Correlate browser execution of unexpected scripts with prior administrator visits to calendar pages
Monitoring Recommendations
- Enable verbose WordPress audit logging to capture plugin option and post meta changes
- Monitor administrator authentication events and follow-on configuration changes within short time windows
- Apply a Content Security Policy (CSP) that blocks inline scripts and alerts on violations
How to Mitigate CVE-2025-46528
Immediate Actions Required
- Deactivate the Availability Calendar plugin until a patched release is verified
- Audit existing calendar entries for stored JavaScript and remove malicious content
- Force a password reset and session invalidation for all WordPress administrators
- Restrict /wp-admin/ access by IP allowlist where operationally feasible
Patch Information
No fixed version has been published in the available references. The vulnerability affects all releases through 0.2.4. Monitor the Patchstack advisory for an updated release and apply it as soon as it becomes available.
Workarounds
- Replace the plugin with an actively maintained alternative that implements WordPress nonce validation and output escaping
- Deploy a web application firewall rule that blocks state-changing requests to plugin endpoints without a valid _wpnonce parameter
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
- Require administrators to use isolated browsers or sessions when managing WordPress to reduce CSRF exposure
# Example WordPress hardening: disable the vulnerable plugin via WP-CLI
wp plugin deactivate availability
wp plugin delete availability
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
