Events Made Easy CVE-2026-118634

Requires an authenticated account with contributor-level privileges or above on the target WordPress site (PR:L), and the ability to publish content containing the plugin's map shortcode (e.g. the global map / single-location map handlers in eme-locations.php). The attacker supplies a crafted 'width' attribute whose value is concatenated unescaped into an inline style attribute; the pre-fix code only checked whether the value ended in %/px/fr/em and never escaped it, allowing a breakout. Exploitation is limited by the need for that contributor-or-higher account (not unauthenticated), and by requiring the injected map shortcode to be rendered on a page an intended victim actually views; execution then needs no further user interaction (UI:N).

This is a medium-severity stored XSS (CVSS 6.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reported by Wordfence. The AV:N/AC:L combination means the request path is simple and network-reachable, but PR:L is the decisive limiter: the attacker must already hold a contributor-level or higher account on the target site, so this is not drive-by mass-exploitable against anonymous visitors. The scope change (S:C) and UI:N are what raise the real impact - an injected script stored in a page runs automatically against any user, including higher-privileged admins, which is the typical escalation path for this class. No EPSS score was supplied in the input, there is no CISA KEV listing, and no confirmed public exploit code is referenced - the references are a vendor advisory, plugin source lines, and the fix commit, not weaponized PoC. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a privilege-gated, non-actively-exploited stored XSS: a genuine item to patch on a normal cadence rather than an emergency. Net assessment: a real but authentication-gated issue whose priority is moderate; the main residual risk is privilege escalation if a contributor account is compromised or a site permits low-trust contributors.

An attacker who already has (or has compromised) a contributor-level WordPress account inserts an Events Made Easy map shortcode into a post or page and supplies a crafted 'width' attribute that breaks out of the generated inline style attribute to inject script. The payload is stored and then executes in the browser of every user who views that page, potentially including an administrator, enabling session/cookie theft or admin-context actions. No confirmed public exploit code is referenced, though the fix commit publicly shows exactly where and how the unsanitized value reached the style attribute.