Cross-site Scripting Vulnerability in Pixelite WP FullCalendar Plugin
CVE-2025-22261

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WP Fullcalendar
Vendor
CVE Published:
7 January 2025

What is CVE-2025-22261?

A Cross-site Scripting (XSS) vulnerability exists in the Pixelite WP FullCalendar plugin, allowing for stored XSS attacks. This vulnerability can potentially enable attackers to inject malicious scripts into web pages that are viewed by users, compromising the security of sensitive information. The issue affects versions n/a through 1.5 of the WP FullCalendar plugin, highlighting the importance of implementing robust input sanitization measures.

Affected Version(s)

WP FullCalendar <= 1.5

References

https://patchstack.com/database/wordpress/plugin/wp-fullc...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
.