Remote Code Execution Vulnerability in Holiday Class Post Calendar Plugin for WordPress

CVE-2025-12813

What is CVE-2025-12813?

The Holiday Class Post Calendar plugin for WordPress is susceptible to a Remote Code Execution vulnerability due to inadequate validation of user-supplied data via the 'contents' parameter. This flaw allows attackers to craft malicious input that is processed by the server, facilitating unauthorized command execution. All versions up to and including 7.1 are affected, and the vulnerability arises from the failure to properly sanitize data when generating cache files, putting affected installations at risk.

References