nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-12976 CVE-2025-12976
MEDIUM
Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode
Record summary
CVE-2025-12976 has a selected CVSS score of 6.4 (medium).
Description
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list_grouped' shortcode in all versions up to, and including, 7.2.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 18, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Events Manager – Calendar, Bookings, Tickets, and more!Browse netweblogic / Events Manager – Calendar, Bookings, Tickets, and more!Default status: unaffected | CVE List | Through 7.2.2.1 | affected |
References
7plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/events-manager/tags/7.2.2.1/classes/em-events.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/events-manager/tags/7.2.2.1/em-functions.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/events-manager/tags/7.2.2.1/em-shortcode.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/events-manager/tags/7.2.2.1/templates/templates/events-list-grouped.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3413776 wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/17e853b2-c7ab-478c-9c89-d8e3a42d1a42?source=cve