CVE-2025-6975 is a reflected cross-site scripting vulnerability in the netweblogic Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin. The flaw exists in the handling of the 'calendar_header' parameter, which lacks proper input sanitization and output escaping. This allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link. The vulnerability affects all versions up to and including 7.0.3. The CVSS 3.1 score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected website, potentially compromising user data confidentiality and integrity. There is no impact on availability. The attack requires user interaction (clicking a malicious link) and does not require authentication. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable parameter if possible. Additionally, applying web application firewall (WAF) rules to detect and block suspicious input targeting the 'calendar_header' parameter may help mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.