This vulnerability (CVE-2025-58862) involves improper input sanitization in the George Sexton WordPress Events Calendar Plugin – connectDaily, which allows stored cross-site scripting attacks. The flaw affects all versions up to 1.5.5. An attacker can inject malicious scripts that are stored by the plugin and executed when other users view the affected content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing the calendar plugin content, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality, integrity, and availability at a low level. The medium severity reflects these impacts combined with the attack complexity and required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor. Until a fix is available, consider restricting plugin usage or applying manual input sanitization if feasible. No vendor advisory states that no action is required or that the issue is mitigated.