CVE-2025-26536
Published: 26 March 2025
Summary
CVE-2025-26536 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious Link (T1204.001); ranked at the 29.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the reflected XSS flaw in the Another Events Calendar WordPress plugin by identifying, reporting, and applying patches within defined timeframes.
Filters information outputs from the plugin during web page generation to neutralize malicious scripts reflected in user inputs.
Validates all inputs to the vulnerable plugin endpoints to prevent improper neutralization leading to XSS execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables delivery via crafted malicious links requiring user click (T1204.001) and execution of scripts to steal session data/cookies (T1539).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar another-events-calendar allows Reflected XSS.This issue affects Another Events Calendar: from n/a through <= 1.7.0.
Deeper analysisAI
CVE-2025-26536 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, affecting the Yendif Player Another Events Calendar WordPress plugin (another-events-calendar). The issue impacts all versions from n/a through 1.7.0 inclusive, as published on 2025-03-26.
With a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the vulnerability is exploitable over the network by unauthenticated attackers requiring low complexity and user interaction, such as clicking a malicious link. Exploitation changes the security scope, enabling limited impacts on confidentiality, integrity, and availability, such as executing scripts in the victim's browser context to steal session data or manipulate page content.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/another-events-calendar/vulnerability/wordpress-another-events-calendar-plugin-1-7-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve details the Reflected XSS vulnerability in the Another Events Calendar plugin version 1.7.0, providing guidance for practitioners on associated risks and potential mitigations.
Details
- CWE(s)