CVE-2025-14945

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/events-manager/trunk/classes/em-event.php#L1206
• https://plugins.trac.wordpress.org/browser/events-manager/trunk/classes/em-event.php#L2608
• https://plugins.trac.wordpress.org/changeset/3567065/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a1985eb5-bfb5-4220-a4f8-fcfa84beae6a?source=cve

Published

Sep 5, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-1494IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a …6.1
• CVE-2025-14940A vulnerability was determined in code-projects Scholars Tra…9.8
• CVE-2025-14941The GZSEO plugin for WordPress is vulnerable to authorizatio…6.4
• CVE-2025-14942wolfSSH’s key exchange state machine can be manipulated to l…9.8
• CVE-2025-14943The Blog2Social: Social Media Auto Post & Scheduler plugin f…4.3
• CVE-2025-14944The Backup Migration plugin for WordPress is vulnerable to M…5.3
• CVE-2025-14946A flaw was found in libnbd. A malicious actor could exploit …4.8
• CVE-2025-14947The All-in-One Video Gallery plugin for WordPress is vulnera…6.5
• CVE-2025-14948The miniOrange OTP Verification and SMS Notification for Woo…5.3
• CVE-2025-1495IBM Business Automation Workflow 24.0.0 and 24.0.1 through 2…4.3
• CVE-2025-14950A weakness has been identified in code-projects Scholars Tra…9.8
• CVE-2025-14951A security vulnerability has been detected in code-projects …9.8