EUVD-2026-51949
GHSA-c58x-hvfg-9vjh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Author-role authentication required (PR:L), victim must visit the page (UI:R), stored XSS crosses into victim browser context (S:C), no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.
AnalysisAI
Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.
Technical ContextAI
The vulnerability is a classic CWE-79 Stored XSS: user-supplied input (event timeline content) is written to the database without sanitization and later reflected into HTML output without escaping. WordPress plugins are expected to use wp_kses() or esc_html()/esc_js() before storing or echoing untrusted content; the absence of these controls is the root cause. The CVSS scope change (S:C) is consistent with stored XSS because the injected payload executes in a victim's browser - a security principal entirely separate from the WordPress application server. The affected CPE is cpe:2.3:a:unknown:event_booking_manager_for_woocommerce:*:*:*:*:*:*:*:* covering all releases up to but not including 5.3.7, as reported by WPScan (https://wpscan.com/vulnerability/96f20744-6751-40a3-92b7-1e93e3b736a4/).
RemediationAI
The primary fix is to update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later, which introduces proper input sanitization and output escaping for event timeline content; the patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/96f20744-6751-40a3-92b7-1e93e3b736a4/. If an immediate update is not possible, the most targeted compensating control is to audit and restrict which user accounts hold the Author role or higher, preventing untrusted or externally registered users from accessing the event-editing capability; this eliminates the attack vector without disabling the plugin, though it reduces platform openness. A secondary control is to deploy a web application firewall rule blocking common XSS payloads in POST parameters associated with event timeline fields, accepting the trade-off that WAF rules can be bypassed by sufficiently obfuscated payloads. No additional workarounds are documented in the available references.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows au
Broken object-level authorization in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3
Stored PayPal and Stripe payment gateway credentials - including secret API keys - can be read by any authenticated Word
Unauthenticated attackers can retrieve registered attendees' personal information-including full names, email addresses,
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today