Executive brief
The 12 Step Meeting List WordPress plugin is used to manage and display recovery meeting information on websites. An unauthenticated attacker can inject malicious JavaScript into the plugin's activity log by submitting specially crafted requests, which then executes in the browser of administrative users when they view the log, potentially allowing account takeover or unauthorized actions.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the plugin's geocoding AJAX handler. The vulnerability exists because user-supplied data submitted to the tsml_geocode action via the address parameter is not properly sanitized or escaped before being stored in the activity log and later displayed in the WordPress admin area. The attack requires only a valid nonce (publicly available on any public meeting page) and no authentication; an attacker can craft a malicious address parameter containing JavaScript code (e.g., <img src=x onerror=alert(document.cookie)>) which persists in the database. When an administrator views the Event Log, the unescaped payload executes in their session, potentially allowing session hijacking or privilege escalation. The vulnerability was fixed in version 3.19.17.
Affected products
- 12 Step Meeting List 12 Step Meeting List 3.17 to 3.19.16
Timeline
- 2026-08-25: disclosed
- 2026-08-27: patched: Fixed in version 3.19.17