CVE-2025-3860

Vulnerability

Overview

The CarDealerPress plugin for WordPress, up to version 6.8.2505.00, contains a Stored Cross-Site Scripting (XSS) vulnerability. The issue stems from insufficient input sanitization and output escaping on the 'saleclass' parameter, allowing malicious script injection.

Exploitation

An authenticated attacker with at least Contributor-level access can exploit this by supplying crafted input to the 'saleclass' parameter. When another user (including administrators) views the affected page, the injected script executes in their browser session. The attack does not require any additional privileges beyond the standard Contributor role.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the victim's session. This can result in data theft, session hijacking, defacement, or further malicious actions within the WordPress dashboard. The stored nature of the XSS means the payload persists until removed.

Mitigation

The vulnerability has been addressed in subsequent versions of the plugin. According to the plugin's changelog, version 6.8.2505.00 includes a fix for XSS in shortcodes [1], and later versions (e.g., 6.8.2507.02) continue to patch related script injection issues. Users are strongly advised to update to the latest available version to mitigate the risk.