CVE-2025-5144

moderate-risk
Published 2025-06-11

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ parameters in all versions up to, and including, 6.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Do I need to act?

-
0.20% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.4/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Stellarwp

References (6)

Not Applicable https://bootstrap-datepicker.readthedocs.io/en/latest/index.html#data-api
Not Applicable https://github.com/uxsolutions/bootstrap-datepicker/blob/master/js/bootstrap-dat...
Product https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.12.0.1/ven...
Product https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.13.0/vendo...
Patch https://plugins.trac.wordpress.org/changeset/3307301/
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/56822fe5-352c-4269-9fa...
30
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal