EUVD-2026-51949
GHSA-c58x-hvfg-9vjh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Author-role authentication required (PR:L), victim must visit the page (UI:R), stored XSS crosses into victim browser context (S:C), no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.
AnalysisAI
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a WordPress user account with at minimum the Author role, which grants post-editing capability on the affected site; sites that allow open registration with Author-level assignment or that have multiple content contributors are directly exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 5.4 (Medium) is broadly appropriate: attack complexity is low, the scope change elevates impact, but the requirement for an authenticated Author-level account (PR:L) and passive victim interaction (UI:R) meaningfully limit the threat surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or obtains an Author-level WordPress account on a target site running the vulnerable plugin, then creates or edits an event and embeds a JavaScript payload (e.g., a cookie-stealing script or admin-action forger) within the event timeline field. When a site administrator subsequently views the public event page - for example, while reviewing event listings - the stored payload executes silently in the admin's browser, potentially exfiltrating their session cookie or issuing authenticated WordPress REST API calls to create a rogue administrator account. … |
| Remediation | The primary fix is to update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later, which introduces proper input sanitization and output escaping for event timeline content; the patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/96f20744-6751-40a3-92b7-1e93e3b736a4/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows au
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today