Stored Cross-Site Scripting in WP Event Manager Plugin by WordPress

CVE-2025-2799

What is CVE-2025-2799?

The WP Event Manager plugin for WordPress, specifically versions up to and including 3.1.49, is susceptible to Stored Cross-Site Scripting attacks through the 'tag-name' parameter. This vulnerability arises from inadequate input sanitization and output escaping. Authenticated users with administrator-level access can exploit this vulnerability to inject malicious web scripts into pages, leading to execution when users visit the compromised pages. Notably, this issue affects only multi-site installations or those where unfiltered_html is disabled, heightening the security risks associated with using this plugin.

References