CVE-2025-22635

CVE-2025-22635 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-Site Scripting (XSS) under CWE-79, affecting the Eventer WordPress plugin developed by imithemes. The issue impacts all versions of Eventer from n/a through those prior to 3.9.9. Published on 2025-02-23, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating high severity due to network accessibility, low attack complexity, no required privileges, user interaction, and scope change with low impacts on confidentiality, integrity, and availability.

Attackers can exploit this vulnerability remotely without authentication by crafting malicious input that is reflected in dynamically generated web pages, tricking users into interacting with it, such as clicking a specially crafted link. Successful exploitation allows attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to low-level theft of sensitive data, minor modifications to page content or behavior, and limited denial of service, with the scope change enabling impacts across security boundaries.

Patchstack's advisory on the vulnerability recommends updating the Eventer WordPress Event Booking Manager plugin to version 3.9.9 or later, where the reflected XSS issue has been addressed. Security practitioners should verify plugin versions on affected WordPress sites and apply the patch promptly, while also implementing general XSS defenses like Content Security Policy where possible.