CVE-2025-14945: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in netweblogic Events Manager – Calendar, Bookings, Tickets, and more!

CVE-2025-14945 is a stored cross-site scripting vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin by netweblogic. The flaw is due to insufficient sanitization of event attribute values during storage (only using wp_unslash() without proper sanitization) and missing output escaping when rendering the '#_ATT{key}' placeholder. This allows authenticated users with Author-level privileges or unauthenticated users (if anonymous submissions are enabled) to inject malicious scripts that execute in the context of any user viewing the event page.

Successful exploitation can lead to execution of arbitrary JavaScript in the browsers of users viewing the affected event pages. This may result in theft of user credentials, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to disable anonymous event submissions if enabled and restrict event creation to trusted users with minimal privileges. Additionally, consider applying web application firewall (WAF) rules to detect and block malicious input patterns targeting event attribute fields.