---
id: CVE-2025-14945
title: >-
  The Events Manager - Calendar, Bookings, Tickets, and more! plugin for
  WordPress is vulnerable to Stored Cross-Site Scripting via event attribute
  values in all versions up to, and including, 7.3.3
summary: >-
  The Events Manager - Calendar, Bookings, Tickets, and more! plugin for
  WordPress is vulnerable to Stored Cross-Site Scripting via event attribute
  values in all versions up to, and including, 7.3.3. This is due to
  insufficient input sanit…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-09-05'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T13:12:58.310'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-14945'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/events-manager/trunk/classes/em-event.php#L1206
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/events-manager/trunk/classes/em-event.php#L2608
    label: security@wordfence.com
  - url: 'https://plugins.trac.wordpress.org/changeset/3567065/'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/a1985eb5-bfb5-4220-a4f8-fcfa84beae6a?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00217
epssPercentile: 0.1239
ingestedAt: '2026-09-06T02:48:39.170Z'
---

## Overview

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.