WordPress Calendar Plugin CVE-2025-14548

Exploitation requires (1) an authenticated account with Contributor-level privileges or higher, and (2) a NON-DEFAULT configuration in which an administrator has used the plugin settings to allow lower-privilege users to manage calendar events - the description explicitly frames this as something the attacker must convince an administrator to enable. The injection vector is the 'event_desc' parameter, which is stored without sufficient sanitization and rendered without output escaping, so the payload fires when any user (notably an administrator) views the affected page. The limiting factors are substantial: the required authentication level and, above all, the opt-in configuration change mean default installations are not exploitable by low-privilege users.

This is a medium-severity stored XSS (CVSS 6.4) with multiple signals pointing to LOW real-world priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) reflects network reach and a changed scope (script executing in an administrator's authenticated context), but the metrics understate the practical barriers described in the text. EPSS is low at 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit code is referenced - only the Wordfence advisory and the trac code/changeset links. Critically, exploitation requires an authenticated Contributor-level (PR:L) account AND a non-default precondition: an administrator must have deliberately enabled lower-privilege users to manage calendar events via the plugin settings. The description further notes the attacker must 'convince an administrator' to grant this, i.e. a social-engineering/mis-configuration dependency that AC:L does not capture. The signals are therefore consistent rather than conflicting: a genuine stored-XSS flaw, but the combination of required authentication, non-default configuration, and low exploitation probability makes this a patch-on-normal-cadence item, not an emergency. Impact is also limited (C:L/I:L/A:N) - session/content manipulation in the admin context rather than full compromise.

On a site where the administrator has enabled Contributor-level users to manage calendar events, a malicious or compromised Contributor submits a calendar event whose 'event_desc' field contains a crafted script payload. When an administrator or other user later views the page rendering that event, the stored script executes in their browser session, potentially performing actions in the admin context. No public exploit code is identified, though the vulnerable code paths are visible in the WordPress plugin trac references.