CVE-2025-52787: Tennis Court Bookings XSS Vulnerability

CVE-2025-52787 Overview

CVE-2025-52787 is a reflected cross-site scripting (XSS) vulnerability in the EZiHosting Tennis Court Bookings WordPress plugin. The flaw affects all versions of tennis-court-bookings up to and including 1.2.7. Attackers can inject malicious scripts that execute in a victim's browser when the victim follows a crafted link. The vulnerability is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

The issue requires user interaction but no authentication, making it suitable for phishing and session compromise scenarios against site administrators or authenticated users.

Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in the victim's browser context, leading to session theft, credential harvesting, and unauthorized actions on the target WordPress site.

Affected Products

EZiHosting Tennis Court Bookings WordPress plugin (tennis-court-bookings)
All versions from initial release through 1.2.7
WordPress installations with the plugin enabled

Discovery Timeline

2025-07-16 - CVE-2025-52787 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-52787

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input that the plugin reflects back into HTML output. When the application echoes request parameters into a response without proper encoding, attackers can inject script tags or event handlers that execute in the victim's browser.

Reflected XSS requires victim interaction, typically clicking a crafted URL. The attacker controls the payload through query parameters or form fields that the plugin processes and renders unsanitized. The scope is changed (S:C), meaning the injected script can affect resources beyond the vulnerable component, including the broader WordPress session context.

The attack delivers low confidentiality, integrity, and availability impact individually, but chained exploitation can escalate to administrator account takeover.

Root Cause

The plugin fails to apply output encoding or input validation when rendering user-controlled data within HTML contexts. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for sanitizing output, but the vulnerable code paths in tennis-court-bookings omit these protections.

Attack Vector

An attacker crafts a URL containing JavaScript payloads in vulnerable parameters processed by the plugin. The attacker delivers the link through phishing email, social media, or compromised third-party content. When an authenticated WordPress user clicks the link, the plugin reflects the payload, and the browser executes it under the site's origin.

The executed script can read cookies, exfiltrate wp-admin session data, perform CSRF actions against the WordPress REST API, or rewrite page content to harvest credentials. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-52787

Indicators of Compromise

Web server access logs containing requests with <script>, javascript:, onerror=, or onload= patterns targeting plugin endpoints
URL-encoded payloads such as %3Cscript%3E or %22%3E%3Cimg in query strings to tennis-court-bookings paths
Unexpected outbound requests from administrator browsers shortly after clicking external links
New or modified WordPress administrator accounts without corresponding audit trail

Detection Strategies

Inspect HTTP request logs for reflected XSS signatures targeting plugin parameters and booking form inputs
Deploy a Web Application Firewall (WAF) rule set that flags HTML and JavaScript event handlers in query parameters
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution attempts

Monitoring Recommendations

Enable WordPress audit logging to capture plugin activity, user role changes, and configuration edits
Forward web server and WAF telemetry to a centralized SIEM for correlation across user sessions
Alert on anomalous administrator authentication events following inbound clicks from external referrers

How to Mitigate CVE-2025-52787

Immediate Actions Required

Disable the Tennis Court Bookings plugin until a patched release is available and verified
Audit recent administrator activity for unauthorized account creation, role changes, or content modification
Force password resets for WordPress administrators and invalidate active sessions
Apply a WAF virtual patch blocking script payloads against plugin endpoints

Patch Information

At the time of publication, the advisory tracks the vulnerability as affecting versions through 1.2.7 with no fixed version confirmed. Monitor the Patchstack Vulnerability Report and the WordPress plugin repository for an updated release.

Workarounds

Remove the tennis-court-bookings plugin from active WordPress installations until a fixed version is released
Restrict access to WordPress administration pages by source IP at the web server or firewall layer
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script sources
Train administrators to avoid clicking unsolicited links pointing to the WordPress site

bash

# Configuration example: Apache rule to block common XSS payloads targeting the plugin
<LocationMatch "/wp-content/plugins/tennis-court-bookings/">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (<|%3C)script (>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (javascript:|onerror=|onload=) [NC]
    RewriteRule .* - [F,L]
</LocationMatch>