CVE-2025-5144: The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5144?
CVE-2025-5144 is considered a medium severity vulnerability due to its potential for stored cross-site scripting.
How do I fix CVE-2025-5144?
To fix CVE-2025-5144, update the Events Calendar plugin for WordPress to version 6.13.3 or later.
Who is affected by CVE-2025-5144?
CVE-2025-5144 affects all versions of the Events Calendar plugin for WordPress up to and including 6.13.2.
What kind of attack can occur due to CVE-2025-5144?
CVE-2025-5144 allows authenticated attackers to exploit stored cross-site scripting vulnerabilities.
What components are involved in CVE-2025-5144?
CVE-2025-5144 involves the 'data-date-*' parameters in the Events Calendar plugin due to insufficient input sanitization.