CVE-2025-12813

Name of the Vulnerable Software and Affected Versions WordPress Holiday Class Post Calendar plugin versions up to and including 7.1

Description The Holiday Class Post Calendar plugin for WordPress is susceptible to Remote Code Execution via the contents parameter. This occurs because the plugin does not properly sanitize user-provided data when creating cache files. This allows unauthenticated attackers to execute code on the server. The issue enables code injection due to improper control of code generation.

Recommendations Update the plugin to a patched version if available. If no patch is available, disable and uninstall the vulnerable plugin instances.