CVE-2025-0862 in SuperSaaS Plugin
Summary
by MITRE • 02/11/2025
The SuperSaaS – online appointment scheduling plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘after’ parameter in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is limited to Chromium-based browsers (e.g. Chrome, Edge, Brave).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/11/2025
The vulnerability identified as CVE-2025-0862 affects the SuperSaaS online appointment scheduling plugin for WordPress, a widely used tool for managing appointment bookings and scheduling. This plugin has been found to contain a stored cross-site scripting vulnerability that exists in all versions up to and including 2.1.12. The flaw specifically resides in the handling of the 'after' parameter, which is processed without adequate input sanitization measures. This represents a significant security weakness that could allow malicious actors to execute arbitrary scripts within the context of affected websites, potentially compromising user sessions and data integrity.
The technical nature of this vulnerability stems from insufficient input validation and output escaping mechanisms within the plugin's codebase. When the 'after' parameter is processed, it fails to properly sanitize user-supplied input before being stored in the database or rendered in web pages. This allows authenticated attackers who possess Contributor-level access or higher to inject malicious scripts that will execute whenever legitimate users access pages containing the injected content. The vulnerability operates as a stored XSS attack because the malicious code is permanently stored on the server and executed each time the affected page is loaded, rather than requiring a single request to trigger the exploit.
The operational impact of this vulnerability extends beyond simple script execution, as it creates a persistent threat vector that can be leveraged for various malicious activities. Attackers could potentially steal user cookies, session tokens, or other sensitive information from authenticated users who access compromised pages. The limitation to Chromium-based browsers such as Chrome, Edge, and Brave suggests that the exploitation technique may rely on browser-specific behaviors or rendering differences, though this does not reduce the severity of the threat. The vulnerability affects any website using the affected plugin version, making it particularly concerning given the plugin's widespread adoption in WordPress environments.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a clear violation of secure coding practices that should be addressed through proper input validation and output encoding. The ATT&CK framework categorizes this as a technique involving code injection and credential access, as the stored XSS could be used to obtain session tokens or other authentication credentials. Organizations using this plugin should immediately implement mitigations including updating to the latest version where available, implementing content security policies, and monitoring for suspicious activity in user accounts. The vulnerability demonstrates the critical importance of validating and sanitizing all user inputs, particularly in web applications where authenticated users have the ability to modify content, as this can create persistent attack vectors that remain active until properly patched.