Medium · 6.5 CVE-2025-32174 EUVD-2025-9839GHSA-gr7j-89m8-pvcj

WordPress Tockify Events Calendar plugin <= 2.2.13 - Cross Site Scripting (XSS) vulnerability

Published Apr 4, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Tockify Product: Tockify Events Calendar

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tockify Tockify Events Calendar tockify-events-calendar allows DOM-Based XSS.This issue affects Tockify Events Calendar: from n/a through <= 2.2.13.

Affected products

Vendor	Product	Affected	Fixed
Tockify	Tockify Events Calendar	≤ 2.2.13	—

References

https://patchstack.com/database/Wordpress/Plugin/tockify-events-calendar/vulnerability/wordpress-tockify-events-calendar-plugin-2-2-13-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry