CVE-2025-12813 — Vulnerability intelligence

strix-bubol5 — Holiday class post calendar

Published: 2025-11-11T03:30:43.449Z

CVSS

9.8

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.

Sources

• CVE-2025-12813
• Original advisory
• Original advisory
• Original advisory
• CVE-2025-12813