CVE-2025-14945
Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.
| CWE | CWE-79 |
| Vendor | netweblogic |
| Product | events manager – calendar, bookings, tickets, and more! |
| Published | Sep 5, 2026 |
| Last Updated | Sep 7, 2026 |
Get instant alerts for netweblogic events manager – calendar, bookings, tickets, and more!
Be the first to know when new medium vulnerabilities affecting netweblogic events manager – calendar, bookings, tickets, and more! are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N