CVE-2025-46528

Summary

CVE-2025-46528 is a newly disclosed vulnerability affecting the Steve Availability Calendar. This issue combines a Cross-Site Request Forgery (CSRF) vulnerability with Stored XSS (Cross-Site Scripting). An attacker could exploit the CSRF weakness to force a user into making unintended actions on the calendar, while the Stored XSS component enables the injection of malicious scripts into calendar pages viewed by other users. The Steve Availability Calendar versions from n/a through 0.2.4 are known to be susceptible to this vulnerability. Users are urged to upgrade to a patched version as soon as possible to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.