CVE-2025-14945: Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes

Q: When can an unauthenticated attacker exploit this issue?

Unauthenticated exploitation is possible only when anonymous event submissions are enabled. Otherwise, an attacker needs Author-level access or higher to submit a malicious event attribute value.

Q: Who is exposed to the injected script?

The injected script executes when any user views the affected event page. This can affect visitors and authenticated users who load the event containing the malicious attribute.

Q: What configuration or feature is involved in triggering the vulnerability?

The affected event must render an event attribute using the #_ATT{key} placeholder. The issue arises because attribute values are stored without sufficient sanitization and that placeholder output is not escaped.

Q: How can administrators look for possible exploitation?

Review event attribute values, particularly for events submitted by Authors or through anonymous submissions, and identify attributes rendered through #_ATT{key} placeholders. Look for unexpected script or HTML content in those values.

Published Sep 5, 2026

Updated

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only wpunslash() without sanitization) and lack of output escaping when rendering the '#ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.

Affected Software

1 affected component

WordPress plugin "Events Manager - Calendar, Bookings, Tickets, and more!"<=7.3.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Events Manager - Calendar, Bookings, Tickets, and more! to a version that resolves this vulnerability.
Fixed in 7.3.3
Configuration
Disable anonymous event submissions in the Events Manager plugin to prevent unauthenticated attackers from submitting malicious event attribute values.
Events Manager (WordPress plugin) anonymous event submissions = disable

Event History

Sep 5, 2026

CVE Published

via MITRE·05:30 AM

Data Sourced

via MITRE·05:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

When can an unauthenticated attacker exploit this issue?

Unauthenticated exploitation is possible only when anonymous event submissions are enabled. Otherwise, an attacker needs Author-level access or higher to submit a malicious event attribute value.

Who is exposed to the injected script?

The injected script executes when any user views the affected event page. This can affect visitors and authenticated users who load the event containing the malicious attribute.

What configuration or feature is involved in triggering the vulnerability?

The affected event must render an event attribute using the #_ATT{key} placeholder. The issue arises because attribute values are stored without sufficient sanitization and that placeholder output is not escaped.

How can administrators look for possible exploitation?

Review event attribute values, particularly for events submitted by Authors or through anonymous submissions, and identify attributes rendered through #_ATT{key} placeholders. Look for unexpected script or HTML content in those values.

CVE-2025-14945: Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes

Affected Software

Remediation

Event History

Frequently Asked Questions

When can an unauthenticated attacker exploit this issue?

Who is exposed to the injected script?

What configuration or feature is involved in triggering the vulnerability?

How can administrators look for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

When can an unauthenticated attacker exploit this issue?

Who is exposed to the injected script?

What configuration or feature is involved in triggering the vulnerability?

How can administrators look for possible exploitation?