CVE-2025-2799: WP Event Manager Stored XSS Vulnerability

CVE-2025-2799 Overview

The WP Event Manager plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.1.49. The flaw resides in the tag-name parameter, where insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject arbitrary web scripts. Injected payloads execute in the browser of any user who visits an affected page. The vulnerability only impacts multi-site installations and installations where unfiltered_html has been disabled. It is tracked under CWE-79.

Critical Impact
Authenticated administrators on WordPress multi-site installations can inject persistent JavaScript payloads that execute in the context of any visiting user, enabling session hijacking, credential theft, or defacement.

Affected Products

WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin
All versions up to and including 3.1.49
WordPress multi-site installations and sites with unfiltered_html disabled

Discovery Timeline

2025-07-16 - CVE-2025-2799 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2799

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw in the WP Event Manager plugin. The plugin accepts data submitted through the tag-name parameter without applying adequate sanitization on input or escaping on output. Malicious markup persisted through this parameter is rendered inline when other users view the resulting page. Because the payload is stored server-side, every subsequent visitor triggers execution without further attacker interaction. On WordPress multi-site environments, the unfiltered_html capability is stripped from administrators by default, which is why this flaw exposes an attack surface not present on standard single-site installs.

Root Cause

The root cause is missing sanitization on the tag-name input and missing contextual output escaping when the value is rendered. WordPress provides helpers such as sanitize_text_field() for input filtering and esc_html() or esc_attr() for output escaping, and the vulnerable code path did not apply them. This omission allows raw HTML and JavaScript to persist in the database and reach the DOM.

Attack Vector

Exploitation requires an authenticated administrator account and user interaction from a subsequent visitor. The attacker submits a crafted tag-name value containing script content through the plugin's tag management interface. When another user loads a page that renders the stored tag, the browser parses and executes the injected script under the site's origin. The scope-changed impact means the payload can affect users beyond the attacker's own site boundary within a multi-site network. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Changeset.

Detection Methods for CVE-2025-2799

Indicators of Compromise

Event or tag records containing <script>, onerror=, onload=, or javascript: sequences in the tag-name field.
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating on pages rendering plugin tags.
New or modified WordPress administrator accounts created shortly after tag edits.

Detection Strategies

Query the WordPress database for tag rows containing HTML control characters such as <, >, or event handler substrings.
Review plugin audit logs for edits to tag taxonomies performed by administrators, especially on multi-site networks.
Inspect rendered event pages with a headless browser or DOM scanner to identify script nodes injected outside expected templates.

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/wp-event-manager/ directory.
Forward WordPress admin activity and web server access logs to a centralized SIEM for correlation with visitor traffic anomalies.
Alert on Content Security Policy (CSP) violations reported by browsers when loading event pages.

How to Mitigate CVE-2025-2799

Immediate Actions Required

Update the WP Event Manager plugin to a version later than 3.1.49 as soon as the fixed release is available.
Audit existing tag entries and remove any that contain HTML markup or scripting constructs.
Restrict administrator access on multi-site networks to trusted personnel and enforce multi-factor authentication.

Patch Information

The upstream fix is committed in the WordPress Plugin Changeset 3309197, which adds proper sanitization and escaping for the tag-name parameter. Site operators should install the patched release from the WordPress plugin repository and confirm the deployed version is greater than 3.1.49.

Workarounds

Temporarily deactivate the WP Event Manager plugin on multi-site networks until the patched version is applied.
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and JavaScript event handlers in the tag-name request parameter.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of any stored payload.

bash

# Configuration example: WordPress CLI to identify vulnerable installs and remove risky tag entries
wp plugin get wp-event-manager --field=version
wp db query "SELECT term_id, name FROM wp_terms WHERE name REGEXP '<|>|script|onerror|onload';"