EUVD-2025-210848
GHSA-3x7x-qm6m-gh57
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Author-level access (PR:L) suffices on default configs; victim must view the event page (UI:R); scope changes to browser; no confidentiality or availability impact beyond script execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only wp_unslash() without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.
AnalysisAI
Stored XSS in the Events Manager WordPress plugin (versions ≤ 7.3.3) enables persistent JavaScript injection via event attribute values using the '#_ATT{key}' template placeholder, which is stored without sanitization and rendered without output escaping. Authenticated users with Author-level access can exploit this on any site running the plugin without special configuration; when the plugin's anonymous event submission feature is enabled (a non-default setting), unauthenticated attackers can achieve the same result. Payloads execute in the browser of any visitor who views the compromised event page. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Events Manager (CPE: cpe:2.3:a:netweblogic:events_manager_-_calendar,_bookings,_tickets,_and_more!:*:*:*:*:*:*:*:*) is a WordPress plugin for event scheduling, ticketing, and booking. The flaw is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) that breaks both halves of the standard sanitize-on-input/escape-on-output defense model simultaneously. At em-event.php:L1206, event attribute values are stored using only wp_unslash() - which strips backslashes but performs no sanitization - allowing arbitrary HTML and script tags to persist in the database. At em-event.php:L2608, the '#_ATT{key}' template placeholder is rendered directly to the page without output escaping, completing the XSS chain. WordPress plugin trac changeset 3567065 addresses both code paths.
RemediationAI
Update the Events Manager plugin to the patched version corresponding to WordPress plugin trac changeset 3567065 or later, applied via the WordPress admin dashboard under Plugins > Updates. Until patching is complete, the most impactful compensating control is to disable anonymous event submissions if that feature is active (Settings > Events Manager > Event Submissions > Allow Anonymous Submissions = No), which eliminates the unauthenticated attack path entirely but leaves the authenticated Author-level path open. Restricting the Author and Contributor roles to verified, trusted staff directly reduces the authenticated path's exposure. A WAF rule blocking HTML tags and script content in event attribute form fields may reduce exploitability but is not a reliable substitute for the patch, as bypass techniques for WAF-based XSS filtering are well-documented.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today