CVE-2025-5144: The Events Calendar WordPress XSS Vulnerability

CVE-2025-5144 Overview

The Events Calendar plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 6.13.2. The flaw resides in the handling of data-date-* parameters, where insufficient input sanitization and output escaping allow authenticated users with Contributor-level privileges or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any visitor who loads the affected page. The vulnerability is classified under CWE-79 and originates from the bundled Bootstrap Datepicker library, which reads attacker-controlled attributes without escaping.

Critical Impact
Authenticated contributors can store JavaScript that executes against site visitors and administrators, enabling session theft, administrative action hijacking, and content defacement.

Affected Products

Stellarwp The Events Calendar for WordPress, all versions through 6.13.2
Installations relying on the bundled vendor/bootstrap-datepicker component
WordPress sites permitting Contributor-level accounts or higher to create event content

Discovery Timeline

2025-06-11 - CVE-2025-5144 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5144

Vulnerability Analysis

The Events Calendar plugin integrates the Bootstrap Datepicker JavaScript library to render date-selection widgets. Bootstrap Datepicker's data-API reads configuration options from HTML data-date-* attributes on target elements. The plugin passes user-supplied event content containing these attributes to the browser without escaping their values.

An authenticated contributor can embed a crafted element in event content so that attribute values are later interpreted as executable script. When any user — including administrators reviewing or publishing events — renders the page, the payload runs under the site's origin. This enables session riding, privilege escalation workflows, exfiltration of administrative tokens, and arbitrary modification of site content.

Root Cause

The root cause is a missing sanitization and output-escaping boundary between stored event data and the Bootstrap Datepicker data-API. The library documentation describes how data-date-* attributes are consumed as configuration, but the plugin treats these attributes as inert markup. Because the attributes feed into DOM operations performed by the datepicker, unescaped quotes and markup break out of the attribute context and introduce attacker-controlled script.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher and user interaction from the victim who loads the affected page. The attacker submits event content containing crafted data-date-* attributes carrying a JavaScript payload. When the page is rendered — including in moderation or preview views used by editors and administrators — the payload executes. The scope changes across the trust boundary of the browser, allowing the payload to act against users with higher privilege than the attacker.

No verified public proof-of-concept is available. See the Wordfence advisory and the Bootstrap Datepicker data-API documentation for technical context.

Detection Methods for CVE-2025-5144

Indicators of Compromise

Event posts or custom post types containing unusual data-date-* attribute values with quotes, angle brackets, or JavaScript keywords such as onerror, onload, or javascript:.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing event pages.
New administrator accounts, modified user roles, or plugin changes made from administrator sessions that correlate with event page views.

Detection Strategies

Query the WordPress wp_posts table and post meta for stored content matching data-date-[a-z0-9_-]+="[^"]*[<>"'] patterns.
Deploy a Content Security Policy in report-only mode and alert on script-src violations originating from event rendering templates.
Review web server access logs for POST requests to /wp-admin/post.php and REST endpoints under /wp-json/tribe/events/ originating from Contributor-level accounts.

Monitoring Recommendations

Monitor the installed version of The Events Calendar across sites and alert when the version is 6.13.2 or earlier.
Audit creation and modification of Contributor, Author, and Editor accounts, including any role changes performed from unexpected IP addresses.
Instrument administrator sessions with browser-side logging to capture anomalous DOM mutations on /wp-admin/edit.php?post_type=tribe_events and related preview routes.

How to Mitigate CVE-2025-5144

Immediate Actions Required

Upgrade The Events Calendar plugin to a version later than 6.13.2 that contains the fix applied in WordPress plugin changeset 3307301.
Audit all event posts created or modified by Contributor-level accounts since the plugin was installed and remove any suspicious data-date-* attributes.
Rotate authentication cookies and administrator passwords if indicators of exploitation are present.

Patch Information

The vendor addressed the issue in the plugin update tracked by WordPress plugin changeset 3307301. The fix adds sanitization and output escaping around the data-date-* attributes consumed by the bundled Bootstrap Datepicker component. Review the diff against the vulnerable Bootstrap Datepicker builds shipped in version 6.12.0.1 and version 6.13.0 to validate backports.

Workarounds

Restrict event authoring to trusted Editor and Administrator accounts until the patch is applied.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script-src to known origins.
Place the site behind a web application firewall rule that blocks requests containing data-date-* attributes with script-like payloads.

bash

# Configuration example: enforce CSP via .htaccess until the plugin is patched
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"