Reflected XSS Vulnerability in Elbisnero WordPress Events Calendar Registration & Tickets

CVE-2025-39372

What is CVE-2025-39372?

A reflected cross-site scripting (XSS) vulnerability exists in the Elbisnero WordPress Events Calendar Registration & Tickets plugin. This flaw allows remote attackers to inject script code, which can be executed in the context of the user’s browser. The malicious script can be triggered when the victim interacts with crafted links. A successful exploit could lead to unauthorized actions being carried out on behalf of the victim or disclosure of sensitive information. Users are urged to update to the latest version to mitigate this risk.

References