PT-2025-52734 · WordPress · Wordpress Calendar

Trung Hieu · Published 2025-12-23 · Updated 2025-12-23 · CVE-2025-14548

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Calendar plugin versions prior to 1.3.17

Description The Calendar plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to insufficient input sanitization and output escaping in the event desc parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page, provided an administrator has enabled lower privilege users to manage calendar events through the plugin settings.

Recommendations Update the Calendar plugin to version 1.3.17 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14548

Affected Products

Wordpress Calendar

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14548 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2e61489d-a433-4d44-bb12-8c84204922b9?source=cve · Note
• https://plugins.trac.wordpress.org/browser/calendar/trunk/calendar.php#L899 · Note
• https://t.me/cveNotify/146637 · Telegram Post
• https://plugins.trac.wordpress.org/browser/calendar/trunk/calendar.php#L2154 · Note
• https://plugins.trac.wordpress.org/changeset?new=3419088%40calendar%2Ftrunk&old=3122280%40calendar%2Ftrunk · Note
• https://t.me/CVEtracker/40472 · Telegram Post
• https://twitter.com/CVEnew/status/2003567301073736009 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2003418964114731046 · Twitter Post