WpEvently CVE-2026-116394

Exploitation requires reaching a WpEvently input field or parameter that improperly neutralizes script-related HTML tags, and - as is inherent to XSS - a victim subsequently rendering the injected content in their browser; the specific vulnerable parameter, page, and whether the payload is stored or reflected are not described in the available sources. The input CVSS vector lists UI:N, but XSS normally depends on a victim loading the affected page, which is the primary real-world limiter here. Affected: WpEvently up to and including 5.7.9; the exact authentication level required for injection is not confirmed beyond the input vector's PR:N.

This is a medium-severity stored/reflected cross-site scripting issue (CWE-80, basic XSS) in the WpEvently WordPress plugin, and the available signals point to a moderate rather than urgent priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) indicates remote, low-complexity, no-privilege exploitation, and per the vector's PR:N value exploitation is unauthenticated. However, the vector's UI:N is atypical for an XSS/CWE-80 issue, which normally requires a victim to load the affected page (UI:R) and often reflects impact into the victim's browser context (S:C, plus some integrity impact) - this input vector appears to understate scope and interaction, so defenders should verify the mechanics with the vendor. No EPSS score is provided, the CVE is not in CISA KEV, and no confirmed working exploit is indicated; the only reference is a Patchstack database entry, not exploit code. The vuln.today decision label is 'this_month' (not act_now or emergency), consistent with a disclosed-but-not-actively-exploited plugin XSS. Net: a genuine issue worth patching on a normal cycle, but not a high-real-risk, actively-exploited emergency.

An attacker injects script-bearing HTML into an input that WpEvently fails to neutralize; when a user (or administrator) subsequently views the affected event page or admin view, the script executes in their browser session. The exact injection point and whether the payload is stored or reflected are not described in the available sources. No confirmed public exploit code is identified at time of analysis.