CVE-2025-6975

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6975", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-01T13:35:27.266Z", "datePublished": "2025-07-09T22:22:47.356Z", "dateUpdated": "2026-04-08T17:17:33.177Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:33.177Z"}, "affected": [{"vendor": "netweblogic", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.6.4.4", "versionType": "semver"}, {"version": "7.0.1", "status": "affected", "lessThanOrEqual": "7.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018calendar_header\u2019 parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3e59b-837b-4058-b7bc-a22cff22afb4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/templates/calendar/section-header-navigation.php#L8"}, {"url": "https://plugins.trac.wordpress.org/changeset/3321403/events-manager"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-06-24T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-07-02T07:23:25.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-09T09:58:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-10T13:09:36.533674Z", "id": "CVE-2025-6975", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-10T13:10:07.456Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6975", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-10T13:09:36.533674Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-10T13:09:58.396Z"}}], "cna": {"title": "Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "netweblogic", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.6.4.4"}, {"status": "affected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-24T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-07-02T07:23:25.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-09T09:58:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3e59b-837b-4058-b7bc-a22cff22afb4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/templates/calendar/section-header-navigation.php#L8"}, {"url": "https://plugins.trac.wordpress.org/changeset/3321403/events-manager"}], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018calendar_header\u2019 parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:33.177Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6975", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:33.177Z", "dateReserved": "2025-07-01T13:35:27.266Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-09T22:22:47.356Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "vendor": "netweblogic", "versions": [{"lessThanOrEqual": "6.6.4.4", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.3", "status": "affected", "version": "7.0.1", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pixelite:events_manager:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "E8D2EDCE-BCE2-408B-84B2-0527475DF849", "versionEndExcluding": "6.6.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:pixelite:events_manager:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "991332B5-2AC7-4B14-A4A6-C7D5EF0E1A4D", "versionEndExcluding": "7.0.4", "versionStartIncluding": "7.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018calendar_header\u2019 parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento Events Manager \u2013 Calendar, Bookings, Tickets, and more! para WordPress es vulnerable a ataques de Cross-Site Scripting Reflejado a trav\u00e9s del par\u00e1metro 'calendar_header' en todas las versiones hasta la 7.0.3 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar al usuario para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2025-6975", "lastModified": "2026-06-17T10:02:58.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6975", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-10T13:09:36.533674Z", "version": "2.0.3"}}]}, "published": "2025-07-09T23:15:24.883", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/templates/calendar/section-header-navigation.php#L8"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3321403/events-manager"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3e59b-837b-4058-b7bc-a22cff22afb4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:47:23.282155+00:00", "value": {"mitigation_remediation": ["Upgrade the Events Manager plugin to a version newer than 7.0.3, which contains the fixed implementation of the calendar_header parameter.", "Configure a web application firewall or security plugin to block or sanitize any input that matches the calendar_header query parameter, preventing XSS payloads from reaching the page.", "Implement a Content Security Policy that restricts script execution to trusted sources, limiting the impact of any residual reflected XSS vectors."], "summary": {"action": "Patch Update", "impact": "Reflected XSS causing arbitrary script execution in victim browsers"}, "threat_synthesis": {"affected_systems": "All installations of the Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress up to and including version 7.0.3 are vulnerable. The issue originates in the plugin code that outputs the calendar_header value without filtering, regardless of user role, meaning any site running a vulnerable version is impacted.", "description_and_impact": "This vulnerability is a reflected Cross\u2011Site Scripting flaw that is triggered by the 'calendar_header' parameter in the Events Manager plugin. The input is not properly sanitized or escaped, so an attacker can embed malicious JavaScript in the URL or form data. If a user visits the crafted link, the script runs in the context of the WordPress site and can execute arbitrary client\u2011side code.", "risk_and_exploitability": "The CVSS score of 6.1 indicates medium severity, while the EPSS score of < 1% signals a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, unauthenticated attacker crafting a malicious link that convinces a victim to click on it; no additional privileges are required beyond the victim\u2019s visit."}}}}, "created": "2026-04-21T20:00:25.885007+00:00", "updated": "2026-04-21T20:00:25.885022+00:00", "vendors": []}