CVE-2025-8392: Mitfahrgelegenheit WordPress Plugin XSS Flaw

CVE-2025-8392 Overview

CVE-2025-8392 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Mitfahrgelegenheit plugin for WordPress. The flaw affects all versions up to and including 1.1.5. The plugin fails to properly sanitize input and escape output for the date parameter. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any visitor who accesses an affected page.

Critical Impact

Authenticated contributors can inject persistent JavaScript that executes against site administrators and visitors, enabling session theft, forced actions, and client-side redirection.

Affected Products

• WordPress Mitfahrgelegenheit plugin versions up to and including 1.1.5
• WordPress sites allowing Contributor-level or higher registration
• Any WordPress deployment with the vulnerable plugin active

Discovery Timeline

• 2025-09-11 - CVE-2025-8392 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8392

Vulnerability Analysis

The Mitfahrgelegenheit plugin accepts user-controlled input through the date parameter without applying adequate sanitization. The plugin also fails to escape this value when rendering it back into HTML output. As a result, attacker-supplied markup, including <script> tags and event handlers, persists in the database and executes in victim browsers.

Stored XSS is more impactful than reflected XSS because the payload survives across sessions and affects every user who loads the injected page. The scope-changed CVSS vector indicates that execution can impact resources beyond the vulnerable component, such as the authenticated admin session rendering the affected content.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping on the date parameter. WordPress provides functions such as sanitize_text_field() for input and esc_html() or esc_attr() for output, but the plugin does not apply them to this parameter in versions through 1.1.5. The vulnerable code path can be reviewed in the plugin source for v1.1.5.

Attack Vector

An attacker authenticates to the WordPress site with at least Contributor privileges. The attacker submits a crafted value in the date parameter containing JavaScript payload content. The payload is stored in the database and rendered without escaping when the affected page is accessed. Any visitor, including administrators, executes the injected script in their browser context, allowing cookie theft, session riding, or forced administrative actions. Technical details are available in the Wordfence vulnerability analysis.

Detection Methods for CVE-2025-8392

Indicators of Compromise

• Posts, pages, or plugin data containing <script>, onerror=, onload=, or javascript: strings in the date field
• Unexpected outbound requests from administrator browsers after viewing contributor-authored content
• New administrator accounts or role changes following access to pages created by Contributor-level users
• Modified wp_options entries or injected <script src="..."> references pointing to external domains

Detection Strategies

• Query the WordPress database for Mitfahrgelegenheit plugin records whose date field contains HTML or script characters
• Audit content submitted by Contributor-level accounts for payloads not matching expected date formats
• Deploy web application firewall rules that block script tags and JavaScript event handlers in plugin parameters
• Review browser console errors and Content Security Policy (CSP) violation reports on affected pages

Monitoring Recommendations

• Alert on creation of Contributor-or-higher accounts followed by submission of plugin-managed content
• Monitor administrator session activity for unusual API calls originating shortly after content viewing
• Log and review all changes to the Mitfahrgelegenheit plugin's stored data for script-like patterns
• Track outbound HTTP requests from admin browsers to unexpected third-party domains

How to Mitigate CVE-2025-8392

Immediate Actions Required

• Deactivate the Mitfahrgelegenheit plugin until a patched release is confirmed and installed
• Audit all existing content and plugin records for injected script payloads and remove them
• Restrict Contributor-level account creation and review existing low-privilege accounts for legitimacy
• Enforce a strict Content Security Policy on the WordPress site to limit inline script execution

Patch Information

At the time of publication, no fixed version is identified in the available advisory data. Monitor the plugin developer page and the Wordfence advisory for a patched release and apply it as soon as it becomes available.

Workarounds

• Remove or disable the Mitfahrgelegenheit plugin on all WordPress instances until a fix is released
• Limit user registration to trusted accounts and revoke Contributor and higher privileges where unnecessary
• Deploy a WAF rule that strips or blocks HTML entities and JavaScript in the date request parameter
• Apply a Content Security Policy header that disallows inline scripts and restricts script sources to trusted origins