CVE-2025-6976

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6976", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-01T14:00:40.285Z", "datePublished": "2025-07-09T22:22:47.733Z", "dateUpdated": "2026-04-08T17:27:21.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:21.447Z"}, "affected": [{"vendor": "netweblogic", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.6.4.4", "versionType": "semver"}, {"version": "7.0.1", "status": "affected", "lessThanOrEqual": "7.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da97a395-64b8-4efd-b189-f917674b1c18?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L287"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L335"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L357"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L485"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-locations.php#L214"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-locations.php#L261"}, {"url": "https://plugins.trac.wordpress.org/changeset/3321403/events-manager"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-06-25T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-07-02T07:23:25.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-09T09:58:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-10T13:41:57.722731Z", "id": "CVE-2025-6976", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-10T13:49:28.842Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6976", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-10T13:41:57.722731Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-10T13:47:53.685Z"}}], "cna": {"title": "Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "netweblogic", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.6.4.4"}, {"status": "affected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-25T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-07-02T07:23:25.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-09T09:58:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da97a395-64b8-4efd-b189-f917674b1c18?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L287"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L335"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L357"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L485"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-locations.php#L214"}, {"url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-locations.php#L261"}, {"url": "https://plugins.trac.wordpress.org/changeset/3321403/events-manager"}], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:21.447Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6976", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:21.447Z", "dateReserved": "2025-07-01T14:00:40.285Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-09T22:22:47.733Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Events Manager \u2013 Calendar, Bookings, Tickets, and more!", "vendor": "netweblogic", "versions": [{"lessThanOrEqual": "6.6.4.4", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.3", "status": "affected", "version": "7.0.1", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pixelite:events_manager:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "E8D2EDCE-BCE2-408B-84B2-0527475DF849", "versionEndExcluding": "6.6.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:pixelite:events_manager:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "991332B5-2AC7-4B14-A4A6-C7D5EF0E1A4D", "versionEndExcluding": "7.0.4", "versionStartIncluding": "7.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento Events Manager \u2013 Calendar, Bookings, Tickets, and more! para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de los shortcodes del complemento en todas las versiones hasta la 7.0.3 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-6976", "lastModified": "2026-06-17T10:02:58.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6976", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-10T13:41:57.722731Z", "version": "2.0.3"}}]}, "published": "2025-07-09T23:15:25.057", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L287"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L335"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L357"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-events.php#L485"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-locations.php#L214"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/classes/em-locations.php#L261"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3321403/events-manager"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da97a395-64b8-4efd-b189-f917674b1c18?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T22:19:01.351014+00:00", "value": {"mitigation_remediation": ["Check for an official patch or update from the plugin author and apply it if available", "If no patch exists, modify the plugin code to properly escape or remove user\u2011supplied shortcode attributes so that scripts cannot be stored", "Restrict contributor\u2011level and higher WordPress roles to the minimum required permissions and audit user accounts for suspicious activity"], "summary": {"action": "Assess", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Events Manager \u2013 Calendar, Bookings, Tickets, and more! plugin up to and including version 7.0.3 are vulnerable. All installations of these versions, regardless of site domain, are affected.", "description_and_impact": "The Events Manager plugin for WordPress stores user\u2011supplied shortcode attributes without adequate sanitization or escaping, creating a stored cross\u2011site scripting flaw. Authenticated contributors or higher can inject arbitrary JavaScript that runs when a visitor loads a page containing the injection, enabling session hijacking, data theft, or defacement.", "risk_and_exploitability": "The CVSS score of 6.4 marks this vulnerability as moderate severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated contributor\u2011level or higher account; the attacker can embed malicious scripts in shortcode attributes that the plugin stores and serves to all visitors."}}}}, "created": "2025-07-13T21:08:03.899489+00:00", "updated": "2026-04-20T22:30:19.867049+00:00", "vendors": ["netweblogic", "netweblogic$PRODUCT$events_manager", "wordpress", "wordpress$PRODUCT$wordpress"]}