CVE-2025-63000
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Stored XSS.This issue affects Sermon Manager: from n/a through <= 2.30.0.
Analysis
Stored cross-site scripting (XSS) in wpforchurch Sermon Manager WordPress plugin through version 2.30.0 allows authenticated users to inject malicious scripts that persist in the database and execute in the browsers of site administrators and other users. The vulnerability affects sermon content input validation, enabling attackers with contributor or editor privileges to compromise website integrity and steal sensitive data from higher-privileged users.
Technical Context
This vulnerability exploits improper input sanitization and output encoding in the Sermon Manager plugin for WordPress, a plugin designed to manage sermon content within WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), which occurs when user-supplied input from sermon creation or editing forms is stored in the database without adequate sanitization and subsequently rendered on the front-end or admin pages without proper HTML entity encoding. WordPress plugins are particularly susceptible to this class of vulnerability when they fail to use WordPress's built-in sanitization functions (sanitize_text_field, wp_kses_post) during data input and escaping functions (esc_html, esc_attr, wp_kses_post) during output. The stored nature of this XSS means the payload persists across sessions and affects multiple users rather than just the attacker's session.
Affected Products
The vulnerability affects the wpforchurch Sermon Manager plugin (CPE identifier: WordPress plugin sermon-manager-for-wordpress) through version 2.30.0 and potentially earlier versions. The advisory does not specify a minimum affected version, suggesting all versions up to and including 2.30.0 are impacted. WordPress installations running Sermon Manager 2.30.0 or earlier with contributor or editor users are in scope.
Remediation
Update Sermon Manager to version 2.30.1 or later immediately, as the patched version addresses the input validation and output encoding defects. Access the WordPress plugin dashboard, navigate to Plugins > Installed Plugins, locate Sermon Manager, and click Update if available. Alternatively, download the latest version from the WordPress plugin repository at https://patchstack.com/database/Wordpress/Plugin/sermon-manager-for-wordpress/. As an interim mitigation on sites unable to update immediately, restrict sermon creation and editing capabilities to administrator accounts only using WordPress role management, and regularly audit existing sermon content for suspicious scripts using the WordPress plugin security scanner or manual database review. Clear any cached plugin code after updating to ensure the patched version is active.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today