CVE-2025-28861

CVE-2025-28861 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP jQuery Persian Datepicker plugin (wpjqp-datepicker) for WordPress, developed by bhzad, that enables stored Cross-Site Scripting (XSS). The issue affects all versions of the plugin up to and including 0.1.0. It has been assigned a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low complexity, lack of required privileges, and scope change.

Attackers can exploit this vulnerability without authentication by tricking authenticated users into performing unintended actions via a malicious website or resource, such as a crafted link or form submission. User interaction is required, but successful exploitation leads to stored XSS, allowing attackers to inject malicious scripts that persist on the site and execute in the context of other users' browsers, potentially resulting in low-level impacts on confidentiality, integrity, and availability with elevated scope.

The Patchstack advisory provides details on the vulnerability, including mitigation recommendations; security practitioners should consult https://patchstack.com/database/Wordpress/Plugin/wpjqp-datepicker/vulnerability/wordpress-wp-jquery-persian-datepicker-plugin-0-1-0-csrf-to-stored-xss-vulnerability?_s_id=cve for patching instructions and further analysis.