Stored Cross-Site Scripting Vulnerability in Mitfahrgelegenheit Plugin for WordPress

CVE-2025-8392

What is CVE-2025-8392?

The Mitfahrgelegenheit plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability through the manipulation of the 'date' parameter in all versions up to and including 1.1.5. This flaw arises from inadequate sanitization of user inputs and failing to escape outputs properly. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability by injecting malicious scripts into pages. These scripts can be executed when users visit the compromised pages, leading to potential unauthorized actions and exposing sensitive information.

References