Medium severity · published Jul 9, 2025
CVE-2025-6975
Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Events Manager – Calendar, Bookings, Tickets, and more! · netweblogic
through 6.6.4.4; 7.0.1 through 7.0.3 · source: vendor
EM
Events Manager · Pixelite
before 6.6.5; 7.0.1 before 7.0.4 · source: NVD
Affected product
EM
Events Manager – Calendar, Bookings, Tickets, and more!
netweblogic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-6975
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-6975
Product
https://plugins.trac.wordpress.org/browser/events-manager/tags/7.0.3/templates/calendar/section-header-navigation.php#L8
Patch
https://plugins.trac.wordpress.org/changeset/3321403/events-manager
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/b6e3e59b-837b-4058-b7bc-a22cff22afb4?source=cve
More from Events Manager – Calendar, Bookings, Tickets, and more!
7.5
CVE-2025-6970
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
7.5
CVE-2024-11260
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter
6.6
CVE-2026-14280
Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
6.5
CVE-2026-15023
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action
6.4
CVE-2025-12976
Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode