Cross-Site Scripting Vulnerability in WordPress Event Manager and Booking Plugin by WordPress
CVE-2025-52730

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WordPress Event Manager, Event Calendar And Booking Plugin
Vendor
CVE Published:
14 August 2025

What is CVE-2025-52730?

A Cross-Site Scripting (XSS) vulnerability exists in the themefunction of the WordPress Event Manager and Booking Plugin. This vulnerability allows an attacker to inject malicious scripts into web pages that can be executed by unsuspecting users, leading to stored XSS attacks. The affected versions range from n/a through 4.0.24, posing a risk to end-users and website integrity.

Affected Version(s)

WordPress Event Manager, Event Calendar and Booking Plugin <= 4.0.24

References

https://patchstack.com/database/wordpress/plugin/eventin-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)
.