CVE-2025-46510

Summary

CVE-2025-46510 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in the Contact Form 7 Calendar plugin for WordPress. This issue enables an attacker to inject malicious scripts into a victim's web browser through a specially crafted request, potentially leading to Stored XSS (Cross-Site Scripting) attacks. The vulnerability exists in Contact Form 7 Calendar versions from n/a through 3.0.1. Successful exploitation could result in unintended actions being taken on the affected website or theft of sensitive user data. It is highly recommended that users upgrade to the latest version of Contact Form 7 Calendar, or consider alternative calendar plugins, to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.