CVE-2025-59131: CSRF in WP-CalDav2ICS WordPress Plugin

The CSRF vulnerability in WP-CalDav2ICS allows an attacker to craft malicious requests that appear to originate from a legitimate user. Successfully exploiting this vulnerability can lead to Stored XSS, where attacker-controlled JavaScript code is stored on the server and executed when other users visit affected pages. This can result in session hijacking, redirection to phishing sites, defacement of the website, or even complete compromise of the WordPress installation. The attacker could steal sensitive user data, including login credentials and personal information, and potentially gain control over the entire WordPress site.

1. Reserved2025-09-09
2. Published2025-12-30
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59131 is to upgrade the WP-CalDav2ICS plugin to a version containing the fix. Until a patched version is available, consider implementing temporary workarounds such as restricting access to the plugin's administrative interface and carefully reviewing any user input that is processed by the plugin. Implementing a Content Security Policy (CSP) can also help mitigate the impact of XSS attacks by restricting the sources from which scripts can be executed. Monitor WordPress logs for suspicious activity, particularly requests to plugin endpoints.

Active installs

200

Plugin rating