Events Made Easy CVE-2026-107649

Exploitation requires two specific plugin settings to be explicitly turned on by a site administrator, both of which default to off: guest event submission (eme_fs[guest_submit]) AND forced location creation (eme_fs[force_location_creation]). The payload must be placed in the event[location_name] parameter and, per the fix, is delivered as HTML-entity-encoded markup to evade wp_kses before browser decoding re-materializes it as live script in the location map balloon. Limiting factors: on default configurations the attack surface does not exist; a victim must subsequently view the injected page for the stored script to fire; and sites updated to version 3.2.23 or later are protected.

This is a moderate-severity Stored XSS (CVSS 5.4, CWE-79) reported by Wordfence with a vendor fix in the commit history, but real-world risk is substantially gated by configuration. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) correctly reflects the tension in this bug: it is network-reachable and unauthenticated (PR:N), yet carries high attack complexity (AC:H) precisely because exploitation requires two non-default settings - guest event submission and forced location creation - to be explicitly enabled by an administrator. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AC:H plus the non-default-config dependency strongly suggests this is a high-CVSS-reachability-but-low-real-world-risk issue rather than a mass-exploitation candidate. The scope change (S:C) and C:L/I:L reflect script execution in victims' browsers against the WordPress site's origin. Note the conflict defenders should weigh: the 'unauthenticated' label is real per PR:N, but it only matters on the minority of sites that deviate from the secure defaults, so prioritization should be driven by configuration audit rather than by the unauthenticated qualifier alone.

On a site where an administrator has enabled both guest event submission and forced location creation, an unauthenticated attacker submits an event whose location_name field carries an HTML-entity-encoded payload (e.g. <img onerror=...>) that slips past wp_kses and is decoded to live markup when rendered in a location map balloon. When any user - including an administrator reviewing submissions - views the affected page, the injected script executes in their browser session. No public exploit code was identified in the provided intelligence.