CVE-2025-12813
Critical · 9.8CVSS
9.8
EPSS
0.9%
Published
Nov 11, 2025
CISA due date
—
The record
The Holiday class post calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.1 via the 'contents' parameter. This is due to a lack of sanitization of user-supplied data when creating a cache file. This makes it possible for unauthenticated attackers to execute code on the server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63378 TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query… CWE-94
- CVE-2026-63346 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
- CVE-2026-63345 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
- CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-94
- CVE-2026-62853 ThingLinks is an enterprise IoT platform. CWE-94
- CVE-2026-62284 OSAC operator is a Kubernetes operator. CWE-94
- CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. CWE-94
- CVE-2026-118635 The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory… CWE-94