Security readout for executives and security teams
Plain-English summary
A WordPress plugin called Calendar Plus (versions through 1.2.4) has a flaw that lets an attacker craft a malicious link. If a logged-in user clicks it, the attacker can run scripts in that person's browser session and potentially take actions or steal data. Sites that use this plugin should review vendor guidance and update once a fix is available.
Executive priority
Treat as a meaningful but not emergency issue. If your marketing or public site uses WordPress with Calendar Plus, assign owners this week to confirm exposure, plan remediation, and follow vendor guidance. Risk centers on hijacking privileged user sessions, not direct server compromise.
Technical view
Reflected Cross-Site Scripting (CWE-79) in the webjunk Calendar Plus WordPress plugin through version 1.2.4. CVSS 3.1 base 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects unauthenticated network exploitation requiring user interaction with scope change, indicating script execution can affect resources beyond the vulnerable component. The Patchstack advisory tracks the issue; no fixed version is named in the provided sources.
Likely exposure
Limited to WordPress sites running the Calendar Plus plugin at version 1.2.4 or earlier. Exposure scales with the plugin's installation footprint and whether site administrators or privileged users can be lured into clicking attacker-supplied links. Public-facing WordPress sites with active editors or admins are the realistic targets.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not listed in CISA KEV. Exploitation requires user interaction (UI:R) such as clicking a crafted link. Scope is changed (S:C), so successful payloads can affect the broader browser session, including potential session hijacking or admin-action abuse against WordPress.
Researcher notes
Reflected XSS with UI:R and S:C in a WordPress plugin context typically maps to admin-targeted phishing chains that pivot to account takeover or content tampering. Sources do not name a fixed version, specific vulnerable parameter, or proof-of-concept. Confirm patched release via the plugin's WordPress.org listing and Patchstack record before closing tickets.
Mitigation direction
- Inventory all WordPress sites and identify any using webjunk Calendar Plus 1.2.4 or earlier.
- Check vendor and Patchstack guidance for an updated plugin release and apply once available.
- If no fix exists, deactivate or remove the Calendar Plus plugin from production sites.
- Apply WAF rules that filter reflected XSS patterns on plugin endpoints until patched.
- Remind administrators and editors not to click unsolicited links pointing at the WordPress admin URL.
Validation and detection
- Use wp-cli or the admin Plugins page to list installed plugins and version of Calendar Plus.
- Confirm whether a patched release is published on the plugin page or vendor advisory.
- After remediation, recheck the plugin version and verify Patchstack advisory status.
- Review web server and WAF logs for suspicious requests targeting Calendar Plus parameters.
- Audit recent administrator sessions for unexpected actions if the plugin was active and exposed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-53350 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.