CVE-2025-66103: 
WordPress vulnerability analysis and mitigation

CVE-2025-66103 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the WPCal.io WordPress plugin developed by Revmakx. It affects all versions of the plugin from n/a through 0.9.5.9 and was published on December 30, 2025. The vulnerability was discovered and reported by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, ENISA EUVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious input is processed and rendered by the client-side JavaScript within the browser's DOM without adequate sanitization, rather than being reflected or stored server-side. Exploitation requires an authenticated attacker with low privileges who can craft a malicious payload that is subsequently rendered in another user's browser session when they interact with the affected plugin functionality. No public technical write-up or proof-of-concept code was available at the time of this report (Red Hat CVE, ENISA EUVD).

Successful exploitation allows an authenticated attacker to inject and execute arbitrary JavaScript in the context of another user's browser session on the affected WordPress site. This can result in session cookie theft, credential harvesting, unauthorized actions performed on behalf of the victim, and defacement or manipulation of page content. The changed scope (S:C) in the CVSS vector indicates the impact can extend beyond the plugin itself to affect the broader WordPress environment and its users (Red Hat CVE, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-66103 as of the time of this report. The vulnerability requires authentication (low privilege) and user interaction, which limits its exploitability compared to unauthenticated vulnerabilities. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the WPCal.io plugin at version 0.9.5.9 or earlier using tools such as WPScan or by inspecting plugin directories exposed via the target site.
2. Authentication: Obtain a low-privileged authenticated account on the target WordPress site (e.g., subscriber or contributor role).
3. Payload crafting: Craft a DOM-Based XSS payload targeting the vulnerable input field or parameter within the WPCal.io plugin that is processed by client-side JavaScript without proper sanitization.
4. Delivery: Submit or share the malicious URL or content containing the payload so that a higher-privileged user (e.g., administrator) interacts with it — for example, by visiting a crafted scheduling link or plugin page.
5. Execution: When the victim's browser processes the malicious input via the DOM, the injected JavaScript executes in their session, enabling cookie theft, session hijacking, or unauthorized actions on the WordPress site (ENISA EUVD).

• Logs: WordPress access logs showing unusual or encoded query parameters in requests to WPCal.io plugin endpoints (e.g., parameters containing <script>, javascript:, or URL-encoded equivalents).
• Network: Outbound requests from victim browsers to unknown external domains shortly after interacting with WPCal.io plugin pages, potentially indicating data exfiltration (e.g., cookie theft via document.cookie).
• File System: Unexpected modifications to WPCal.io plugin files or the WordPress database entries associated with the plugin's scheduling data.
• Process/Behavior: Reports from users of unexpected redirects, pop-ups, or unauthorized actions (e.g., password changes, new admin accounts) occurring after visiting WPCal.io-related pages.

WordPress site administrators should update the WPCal.io plugin to a version beyond 0.9.5.9 if a patched release is available from the plugin vendor (Revmakx). If no patch is currently available, the recommended workaround is to deactivate and remove the WPCal.io plugin until a fix is released. Additionally, restricting plugin access to trusted authenticated users and implementing a Web Application Firewall (WAF) with XSS filtering rules can reduce exposure (Red Hat CVE, ENISA EUVD).