Executive brief
The Events Manager plugin for WordPress, used to manage calendar events, bookings, and ticket sales, contains a stored cross-site scripting vulnerability in event attribute handling. Attackers with author access (or via unauthenticated event submissions if enabled) can inject malicious scripts into event attributes that execute when other users view the event page, potentially leading to session hijacking, credential theft, or defacement.
Technical details
The vulnerability is a stored XSS flaw in the Events Manager plugin (versions up to 7.3.3) caused by insufficient input sanitization and output escaping in event attribute processing. The plugin uses only `wp_unslash()` when storing attribute values without proper sanitization, and fails to escape output when rendering the '#_ATT{key}' placeholder. Authenticated attackers with Author-level permissions, or unauthenticated users if anonymous event submissions are enabled, can inject arbitrary JavaScript into event attributes. The injected payload persists in the database and executes in the context of any user viewing the affected event page. No patch version information is provided in the advisory.
Affected products
- Events Manager Events Manager up to and including 7.3.3
Timeline
- 2025-09-05: disclosed