CVE-2025-58213: Trafft Booking System Stored XSS Vulnerability

CVE-2025-58213 Overview

CVE-2025-58213 is a stored Cross-Site Scripting (XSS) vulnerability in the ameliabooking Booking System Trafft plugin for WordPress. The flaw stems from improper neutralization of user input during web page generation, classified under [CWE-79]. Attackers with low privileges can inject persistent JavaScript payloads that execute in the browsers of users viewing affected pages. The vulnerability affects all plugin versions up to and including 1.0.14. Successful exploitation requires user interaction and can compromise session data, redirect users, or perform actions in the authenticated user context.

Critical Impact
Authenticated attackers can store malicious scripts that execute across security boundaries, enabling session theft and account compromise against WordPress users interacting with the booking system.

Affected Products

ameliabooking Booking System Trafft plugin for WordPress
All versions from n/a through 1.0.14
WordPress sites with the booking-system-trafft plugin installed

Discovery Timeline

2025-08-27 - CVE-2025-58213 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58213

Vulnerability Analysis

The Booking System Trafft plugin fails to properly sanitize user-supplied input before rendering it within HTML output. An authenticated attacker with low-level privileges submits crafted input containing JavaScript payloads through plugin-exposed fields. The plugin stores this input and later renders it to other users without adequate encoding or filtering.

The scope change indicated in the CVSS vector shows the vulnerability crosses trust boundaries. Injected scripts execute in the context of the WordPress site, potentially reaching administrators or other privileged users. Because exploitation requires user interaction, the attack typically triggers when a victim views a booking page or administrative panel containing the stored payload.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders user-controlled data into web pages. WordPress provides functions such as esc_html(), esc_attr(), and wp_kses() for context-aware sanitization. The plugin does not apply these consistently to fields accessible to lower-privileged users, allowing raw HTML and script content to persist in the database and reach the browser.

Attack Vector

An attacker authenticates to the WordPress site with a low-privilege account permitted to interact with the booking plugin. The attacker submits a booking or profile field containing a JavaScript payload. When an administrator or another user loads a page that displays the stored value, the payload executes with their session privileges. Consequences include session hijacking, credential harvesting, forced administrative actions, and pivoting to additional site compromise.

See the Patchstack Plugin Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-58213

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (for example onerror, onload) stored in booking-related database tables.
Outbound HTTP requests from user browsers to unfamiliar domains after loading booking pages.
New or modified WordPress administrator accounts following legitimate user visits to booking pages.
Anomalous session cookies transmitted to external hosts observed in web proxy or WAF logs.

Detection Strategies

Query the WordPress database for entries in plugin tables containing HTML tags or JavaScript keywords such as <script, javascript:, or onerror=.
Review web server access logs for POST requests to Booking System Trafft endpoints containing URL-encoded script payloads.
Enable Content Security Policy (CSP) reporting to surface inline script violations on affected pages.

Monitoring Recommendations

Monitor authenticated user sessions for unusual privilege escalations or configuration changes shortly after visits to booking pages.
Alert on WordPress role changes, plugin installations, and administrator account creation events.
Track browser telemetry and endpoint activity for signs of credential theft originating from WordPress administrative sessions.

How to Mitigate CVE-2025-58213

Immediate Actions Required

Identify all WordPress installations running the Booking System Trafft plugin at version 1.0.14 or earlier.
Deactivate the plugin until a patched version is verified and deployed.
Rotate WordPress administrator credentials and invalidate active sessions if any suspicious content is discovered in plugin storage.
Audit user roles and remove unnecessary low-privilege accounts that could be leveraged for injection.

Patch Information

At the time of publication, the advisory lists affected versions through 1.0.14. Site operators should consult the Patchstack advisory and the plugin vendor for the current patched release, and upgrade to the fixed version once available.

Workarounds

Deploy a web application firewall (WAF) rule set to block requests containing script tags and common XSS payload patterns targeting plugin endpoints.
Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict access to the booking system to authenticated, trusted users only, and disable public registration where feasible.
Sanitize existing stored data by purging or escaping HTML in plugin database tables before re-enabling the plugin.

bash

# Example: search WordPress database for stored script payloads
wp db query "SELECT * FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%onerror=%';"

# Deactivate the vulnerable plugin from the CLI
wp plugin deactivate booking-system-trafft