Vulnerability details

CVE-2025-2800

WP Event Manager – Events Calendar

WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'

CVSS 3.1

7.2High

Official description

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘organizer_name' parameter in all versions up to, and including, 3.1.50 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS scores

Score	Version	Source	Vector
7.2High	3.1	CVEProject cvelistV5 (CNA) (Wordfence)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N`

Affected products

Vendor	Product	Versions	Source
WP Event Manager	WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce	v ≤ 3.1.50	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-07-16
Last updated: 2026-04-08
State: Published
Assigner (CNA): Wordfence

Exploit prediction (EPSS)

0.29%

Probability of exploitation in 30 days

22.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')