Stored Cross-Site Scripting in Events Calendar Made Simple Pie Calendar Plugin for WordPress
CVE-2025-1410
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 February 2025
What is CVE-2025-1410?
The Pie Calendar plugin for WordPress is prone to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on user-supplied attributes within the plugin's piecal shortcode. This vulnerability allows attackers with contributor-level access or higher to inject harmful web scripts. When other users access a compromised page, these scripts can execute, leading to potential data exposure or site compromise.
Affected Version(s)
Events Calendar Made Simple – Pie Calendar * <= 1.2.5