CVE-2025-58887

WordPress Course Booking Platform Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability

View on CVE.org
Published Sep 5, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG Course Booking Platform course-booking-platform allows Stored XSS.This issue affects Course Booking Platform: from n/a through <= 1.0.0.

Analysis

AI-generated

Technical impact

The vulnerability is a stored cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript into pages generated by the plugin. When a script is saved within the course booking data, it is rendered on the front‑end without proper neutralization, allowing malicious code execution on any site visitor.

Affected Systems

This flaw affects the WordPress Plugin "Course Booking Platform" from the vendor Course Finder | andré martin - it solutions & research UG, specifically any instance using version 1.0.0 or earlier. All releases from the initial version through 1.0.0 are impacted, with no fix currently released.

Risk and Exploitability

The vulnerability carries a moderate CVSS score of 6.5. Its EPSS score is below 1 %, indicating a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. The most likely attack vector is via the plugin's administrative interface, where a user with sufficient privileges can inject malicious code into stored course data that is then served to all visitors.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Course Booking Platform to a version that contains the XSS fix.
  • If an update is not immediately available, restrict or remove the vulnerable input fields and reuse a dedicated input‑sanitization plugin or custom code that strips disallowed tags before rendering.
  • Enforce a Content Security Policy that disallows inline scripts or external script execution from data entered through the plugin, mitigating any remaining stored‑XSS payloads.

Generated by OpenCVE AI on April 30, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-26889 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG Course Booking Platform allows Stored XSS. This issue affects Course Booking Platform: from n/a through 1.0.0.
History
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions &amp; research UG Course Booking Platform course-booking-platform allows Stored XSS.This issue affects Course Booking Platform: from n/a through <= 1.0.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG Course Booking Platform course-booking-platform allows Stored XSS.This issue affects Course Booking Platform: from n/a through <= 1.0.0.
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG Course Booking Platform allows Stored XSS. This issue affects Course Booking Platform: from n/a through 1.0.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions &amp; research UG Course Booking Platform course-booking-platform allows Stored XSS.This issue affects Course Booking Platform: from n/a through <= 1.0.0.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG Course Booking Platform allows Stored XSS. This issue affects Course Booking Platform: from n/a through 1.0.0.
Title WordPress Course Booking Platform Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Sep 5, 2025, 10:50 AM

View source JSON

Updated
Sep 5, 2025, 2:05 PM

JSON

Status
Deferred
Published
Sep 5, 2025, 2:16 PM
Modified
Jun 17, 2026, 9:45 AM

View source JSON

No data.

Updated
Apr 30, 2026, 3:30 PM

JSON