Mitfahrgelegenheit is a WordPress plugin that has a stored cross‑site scripting flaw in the ‘date’ parameter. Data written to this field is saved without sufficient sanitization or escaping, enabling an attacker who can create or edit an entry to submit arbitrary JavaScript. When a visitor later loads a page that contains the injected content, the script runs in the visitor’s browser. The flaw is categorized as CWE‑79.

All installations of the Mitfahrgelegenheit WordPress plugin with a version of 1.1.5 or earlier are vulnerable. The vulnerability exists regardless of where the plugin is used on a site; any page that displays data stored through the ‘date’ field is affected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog, indicating that no publicly disclosed exploitation has occurred. Attackers must be authenticated with Contributor level or higher in order to submit data that triggers the flaw; once the malicious content is stored, it persists until a site administrator removes or sanitizes it, creating a long‑term threat to any user who views the affected page.