The Intl DateTime Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages. These scripts will execute whenever a user accesses an injected page, posing a significant security risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-8293 |
Exploitation
To exploit this vulnerability, an attacker with Contributor-level access can craft a malicious request that includes a specially formatted ‘date’ parameter. When this request is processed, the injected script will be stored and executed whenever a user accesses the affected page, allowing the attacker to execute arbitrary JavaScript in the context of the user’s session.
Affected Products
- Intl DateTime Calendar plugin for WordPress (versions up to and including 1.0.1): This plugin is specifically vulnerable due to its failure to properly sanitize and escape user input.
Mitigation
To mitigate this vulnerability, users should update the Intl DateTime Calendar plugin to the latest version where the issue has been resolved. Additionally, implementing proper input validation and output escaping practices can help prevent similar vulnerabilities in the future.