Executive brief
The Next Date plugin for WordPress, which is used to display dates on websites, contains a security flaw that allows users with contributor-level access or higher to inject malicious scripts into pages. These scripts execute automatically whenever a visitor views the affected page, potentially leading to unauthorized actions or data theft. This vulnerability impacts all versions of the plugin up to and including version 1.0.
Technical details
The Next Date plugin for WordPress (versions up to 1.0) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'default' shortcode attribute. An authenticated attacker with contributor-level permissions or higher can inject arbitrary web scripts into a post or page using the shortcode. Because the plugin fails to properly neutralize this input, the script is stored on the server and executes in the browser of any user who visits the compromised page. This can be used to hijack sessions or perform actions on behalf of other users. As of the advisory date, the vulnerability exists in version 1.0 and the current trunk.
Affected products
- WordPress Next Date Up to and including 1.0
Timeline
- 2026-05-12: disclosed: Vulnerability published by Wordfence and NVD.