Stored Cross-Site Scripting Vulnerability in WpEvently Plugin for WordPress
CVE-2025-5568
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 June 2025
What is CVE-2025-5568?
The WpEvently plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and insufficient output escaping across multiple parameters in all versions up to 4.4.2. Authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject malicious web scripts. Such scripts can execute whenever a user accesses an affected page, potentially compromising user data and the integrity of the site.
Affected Version(s)
Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin * <= 4.4.2