Stored Cross-Site Scripting Vulnerability in Event RSVP and Simple Event Management Plugin for WordPress
CVE-2025-5540

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Event Rsvp And Simple Event Management Plugin
Vendor
CVE Published:
26 June 2025

Badges

👾 Exploit Exists📰 News Worthy

What is CVE-2025-5540?

The Event RSVP and Simple Event Management Plugin for WordPress has a vulnerability allowing authenticated attackers with contributor-level access or higher to execute arbitrary scripts on affected pages. This weakness stems from inadequate input sanitization and output escaping related to the plugin's 'emd_mb_meta' shortcode, potentially leading to unauthorized data exposure and manipulation whenever users access the compromised pages.

Affected Version(s)

Event RSVP and Simple Event Management Plugin * <= 4.1.0

News Articles

favicon imageINCIBE

Vulnerabilities | INCIBE-CERT | INCIBE

CVE-2025-5540 Publication date: 26/06/2025 The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored...

3 weeks ago

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/wp-easy-events/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by INCIBE

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha
.