Is CVE-2025-14945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-14945 being exploited in the wild.

How severe is CVE-2025-14945?

Medium severity, with a CVSS score of 5.4, published 5 September 2026.

Which products and versions are affected?

Events Manager Events Manager up to and including 7.3.3.

Is there a fix for CVE-2025-14945?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-14945 attacked?

It is attacked over the network.

Am I affected by CVE-2025-14945?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-14945: Events Manager Calendar Bookings Tickets stored XSS in event attributes

CVE-2025-14945 · Severity: medium · CVSS 5.4 · Published 2026-09-05

The Events Manager plugin for WordPress, used to manage calendar events, bookings, and ticket sales, contains a stored cross-site scripting vulnerability in event attribute handling. Attackers with author access (or via unauthenticated event submissions if enabled) can inject malicious scripts into event attributes that execute when other users view the event page, potentially leading to session hijacking, credential theft, or defacement.

Quick answers

Is CVE-2025-14945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-14945 being exploited in the wild.
How severe is CVE-2025-14945?: Medium severity, with a CVSS score of 5.4, published 5 September 2026.
Which products and versions are affected?: Events Manager Events Manager up to and including 7.3.3.
Is there a fix for CVE-2025-14945?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-14945 attacked?: It is attacked over the network.
Am I affected by CVE-2025-14945?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS flaw in the Events Manager plugin (versions up to 7.3.3) caused by insufficient input sanitization and output escaping in event attribute processing. The plugin uses only `wp_unslash()` when storing attribute values without proper sanitization, and fails to escape output when rendering the '#_ATT{key}' placeholder. Authenticated attackers with Author-level permissions, or unauthenticated users if anonymous event submissions are enabled, can inject arbitrary JavaScript into event attributes. The injected payload persists in the database and executes in the context of any user viewing the affected event page. No patch version information is provided in the advisory.

Affected products

Events Manager Events Manager up to and including 7.3.3

Timeline

2025-09-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.