CVE-2025-28960

The Evangelische Termine plugin for WordPress (versions up to 3.3) contains a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This flaw enables an attacker to inject arbitrary HTML and JavaScript into the application's response.

Exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form [1]. The vulnerability is expected to be used in mass-exploit campaigns, targeting thousands of websites regardless of size or popularity [1].

Successful exploitation allows an attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads, which execute when other users visit the affected site [1]. This can lead to defacement, credential theft, or further compromise.

As an immediate mitigation, users should update the plugin to a patched version if available. If updating is not possible, applying a mitigation rule from Patchstack can block attacks until an official patch is released [1].