CVE-2025-52730: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the WordPress Event Manager, Event Calendar and Booking Plugin, identified as CVE-2025-52730. The vulnerability was reported on May 22, 2025, by Tran Nguyen Bao Khanh from VCI - VNPT Cyber Immunity and affects versions through 4.0.24 of the plugin. The issue stems from improper neutralization of input during web page generation, allowing for stored XSS attacks (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue requires subscriber-level privileges to exploit, indicating that authentication is necessary for successful exploitation (Patchstack, NVD).

This vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site, potentially compromising user data and website integrity (Patchstack).

The vulnerability has been fixed in version 4.0.25 of the WordPress Event Manager, Event Calendar and Booking Plugin. Users are advised to update to version 4.0.25 or later immediately. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).