CVE-2025-14945: Netweblogic Events Manager – Calendar, Bookings, Tickets, And More!

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.

Affected products

• Netweblogic Events Manager – Calendar, Bookings, Tickets, And More!: up to and including 7.3.3

Published 2026-09-05. Last modified 2026-09-08.