CVE-2025-58008

Vulnerability

Overview

The vulnerability is a Stored Cross-Site Scripting (XSS) in the WordPress plugin Participants Database, versions n/a through 2.7.6.3. The root cause is improper neutralization of user-supplied input during web page generation, allowing arbitrary HTML and JavaScript to be stored and later executed in the context of other users' browsers [1].

## Exploitation requires a privileged user (e.g., administrator) to perform an action such as clicking a crafted link or submitting a form, but the injected payload persists and executes when any visitor accesses the affected page. No authentication is needed for the stored payload to trigger on subsequent page loads [1].

## An attacker can inject malicious scripts that may redirect visitors, display advertisements, or deliver other HTML payloads. This can lead to defacement, data theft, or further compromise of the site and its users [1].

## The vendor has released version 2.7.7 which resolves the issue. Users are strongly advised to update immediately. Patchstack users can enable auto-updates for vulnerable plugins. The vulnerability is considered low severity but is known to be used in mass-exploit campaigns [1].