CVE-2025-14945: Events Manager WordPress Plugin XSS Flaw

CVE-2025-14945 Overview

CVE-2025-14945 is a Stored Cross-Site Scripting (XSS) vulnerability in the Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress. The flaw affects all versions up to and including 7.3.3. The plugin stores event attribute values using only wp_unslash() without proper sanitization and fails to escape output when rendering the #_ATT{key} placeholder. Authenticated attackers with Author-level access can inject arbitrary JavaScript. When anonymous event submissions are enabled, unauthenticated attackers can also exploit the flaw. Injected scripts execute in the browser of any user who views the affected event page [CWE-79].

Critical Impact
Stored JavaScript payloads execute in the context of every visitor to a compromised event page, enabling session theft, administrator account takeover, and arbitrary actions on behalf of authenticated users.

Affected Products

Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress
All versions up to and including 7.3.3
WordPress sites with anonymous event submissions enabled (expanded attack surface)

Discovery Timeline

2026-09-05 - CVE-2025-14945 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2025-14945

Vulnerability Analysis

The vulnerability resides in how the Events Manager plugin processes and renders custom event attributes. When an event is created or updated, the plugin captures attribute values from user-supplied input and passes them through wp_unslash() only. This function strips backslashes added by WordPress but performs no sanitization against HTML or script content.

On the rendering side, the plugin substitutes the #_ATT{key} placeholder with the stored attribute value directly into the page output. No escaping function such as esc_html(), esc_attr(), or wp_kses() is applied. As a result, script tags and event handlers embedded in attribute values are rendered as executable HTML in the browser.

The stored nature of the payload makes it persistent. Every visitor to the event page executes the attacker-supplied JavaScript, including administrators viewing the front-end.

Root Cause

The root cause is missing input sanitization and missing output escaping in the plugin's event attribute handling code. The vulnerable logic is present in classes/em-event.php around lines 1206 and 2608, as referenced in the WordPress plugin trac. The fix was committed in changeset 3567065.

Attack Vector

An attacker with Author-level access or higher submits an event containing a crafted attribute value with an embedded script payload. When anonymous event submission is enabled on the target site, no authentication is required, which significantly widens the attack surface. The payload persists in the database and executes whenever the event page is rendered for any viewer. The Wordfence advisory provides additional exploitation context.

See the linked WordPress trac references for the exact vulnerable code paths. No verified public proof-of-concept exploit is available at this time.

Detection Methods for CVE-2025-14945

Indicators of Compromise

Event records in wp_em_events or related tables containing <script>, onerror=, onload=, or javascript: strings within attribute value columns
Unexpected outbound requests from user browsers to attacker-controlled domains after viewing event pages
New administrator accounts or modified user roles following visits to event pages by privileged users
Web server access logs showing event submissions from Author-level accounts or anonymous submissions containing HTML-encoded script payloads

Detection Strategies

Query the plugin's event attribute storage for patterns matching common XSS payloads such as <script, onerror, onmouseover, and srcdoc
Enable Content Security Policy (CSP) reporting to capture inline script violations originating from event pages
Review WordPress audit logs for event creation and modification activity by Author-level accounts with unusual attribute content

Monitoring Recommendations

Monitor plugin update status and alert on installations running Events Manager version 7.3.3 or earlier
Log all anonymous event submissions and flag submissions containing angle brackets or JavaScript-specific keywords in attribute fields
Alert on administrator sessions initiating unexpected privileged actions shortly after visiting front-end event pages

How to Mitigate CVE-2025-14945

Immediate Actions Required

Update the Events Manager plugin to the patched version released via changeset 3567065 immediately
Audit all existing event records for previously injected script content and sanitize or remove affected entries
Disable anonymous event submissions until the plugin is patched to reduce the unauthenticated attack surface
Review Author-level and above accounts for suspicious activity and rotate credentials where compromise is suspected

Patch Information

The vendor addressed the vulnerability in the version following 7.3.3. The fix adds proper sanitization on attribute storage and output escaping when rendering the #_ATT{key} placeholder. Refer to the WordPress plugin changeset 3567065 for the committed patch and the Wordfence advisory for remediation guidance.

Workarounds

Restrict event creation privileges to trusted Editor-level or Administrator-level users only until patching is complete
Deploy a web application firewall (WAF) rule blocking event submissions containing <script, on*=, or javascript: patterns in attribute parameters
Implement a strict Content Security Policy that disallows inline scripts on pages rendering event content
Disable anonymous event submissions in the plugin configuration

bash

# WordPress CLI: update the Events Manager plugin to the patched release
wp plugin update events-manager

# Verify the installed version is greater than 7.3.3
wp plugin get events-manager --field=version