CVE-2025-8392

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8392", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-30T19:52:15.500Z", "datePublished": "2025-09-11T07:24:57.220Z", "dateUpdated": "2026-04-08T17:11:29.545Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:29.545Z"}, "affected": [{"vendor": "bessermitfahren", "product": "Mitfahrgelegenheit", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018date\u2019 parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Mitfahrgelegenheit <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd819c2-45ab-4e0d-b29a-d92722db7164?source=cve"}, {"url": "https://plugins.svn.wordpress.org/mitfahrgelegenheit/tags/v1.1.5/mitfahrgelegenheit.php"}, {"url": "https://wordpress.org/plugins/mitfahrgelegenheit/#developers"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-09-10T18:45:55.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T13:45:29.621340Z", "id": "CVE-2025-8392", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:38:43.849Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8392", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T13:45:29.621340Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T13:45:31.658Z"}}], "cna": {"title": "Mitfahrgelegenheit <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "bessermitfahren", "product": "Mitfahrgelegenheit", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T18:45:55.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd819c2-45ab-4e0d-b29a-d92722db7164?source=cve"}, {"url": "https://plugins.svn.wordpress.org/mitfahrgelegenheit/tags/v1.1.5/mitfahrgelegenheit.php"}, {"url": "https://wordpress.org/plugins/mitfahrgelegenheit/#developers"}], "descriptions": [{"lang": "en", "value": "The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018date\u2019 parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:29.545Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8392", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:29.545Z", "dateReserved": "2025-07-30T19:52:15.500Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:57.220Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mitfahrgelegenheit", "vendor": "bessermitfahren", "versions": [{"lessThanOrEqual": "1.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018date\u2019 parameter in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-8392", "lastModified": "2026-06-17T10:06:52.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8392", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T13:45:29.621340Z", "version": "2.0.3"}}]}, "published": "2025-09-11T08:15:33.290", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/mitfahrgelegenheit/tags/v1.1.5/mitfahrgelegenheit.php"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/mitfahrgelegenheit/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd819c2-45ab-4e0d-b29a-d92722db7164?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:49:33.307950+00:00", "value": {"mitigation_remediation": ["Update to the latest Mitfahrgelegenheit plugin release that removes the vulnerable \u2018date\u2019 parameter handling; if no update is immediately available, contact the plugin developer for a fix.", "If an update cannot be applied, prevent Contributors and higher roles from creating or editing entries that include the \u2018date\u2019 field, or disable the date field via the plugin\u2019s configuration or custom code to stop new payloads.", "Review existing content for injected JavaScript and either delete or sanitize the affected entries, ensuring that all stored data displayed on the site is properly escaped to prevent future script execution."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting that allows authenticated users to inject and execute arbitrary scripts"}, "threat_synthesis": {"affected_systems": "All installations of the Mitfahrgelegenheit WordPress plugin with a version of 1.1.5 or earlier are vulnerable. The vulnerability exists regardless of where the plugin is used on a site; any page that displays data stored through the \u2018date\u2019 field is affected.", "description_and_impact": "Mitfahrgelegenheit is a WordPress plugin that has a stored cross\u2011site scripting flaw in the \u2018date\u2019 parameter. Data written to this field is saved without sufficient sanitization or escaping, enabling an attacker who can create or edit an entry to submit arbitrary JavaScript. When a visitor later loads a page that contains the injected content, the script runs in the visitor\u2019s browser. The flaw is categorized as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog, indicating that no publicly disclosed exploitation has occurred. Attackers must be authenticated with Contributor level or higher in order to submit data that triggers the flaw; once the malicious content is stored, it persists until a site administrator removes or sanitizes it, creating a long\u2011term threat to any user who views the affected page."}}}}, "created": "2025-09-12T09:11:19.980086+00:00", "updated": "2026-04-22T01:00:04.356270+00:00", "vendors": ["mitfahrgelegenheit", "mitfahrgelegenheit$PRODUCT$mitfahrgelegenheit_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}