Reflected Cross-Site Scripting Vulnerability in Events Manager Plugin for WordPress
CVE-2025-6975
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 July 2025
What is CVE-2025-6975?
The Events Manager plugin for WordPress suffers from a vulnerability that allows for Reflected Cross-Site Scripting. This issue exists due to inadequate input sanitization and output escaping on the 'calendar_header' parameter. Attackers can exploit this weakness to inject malicious scripts into web pages. If an unwitting user clicks on a specially crafted link, the script executes in their browser context, posing a significant risk to user data and site integrity.
Affected Version(s)
Events Manager – Calendar, Bookings, Tickets, and more! * <= 6.6.4.4
Events Manager – Calendar, Bookings, Tickets, and more! 7.0.1 <= 7.0.3