Stored Cross-Site Scripting in Conference Scheduler Plugin for WordPress

CVE-2025-5258

What is CVE-2025-5258?

The Conference Scheduler plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'className' parameter due to inadequate input sanitization and output escaping. This vulnerability allows authenticated attackers, with Contributor-level access or higher, to inject arbitrary scripts into pages. When a user accesses such a page, the injected scripts can execute, potentially compromising user data and site integrity.

References