Events Manager CVE-2026-17089

The Events Manager plugin must be installed and active on the target WordPress site. The attack targets the 'search_events_grouped' AJAX action, which is registered without any WordPress capability check (as shown in em-actions.php lines 891 and 920), making it reachable by unauthenticated visitors via admin-ajax.php - no attacker account is required. The critical limiting condition is that a victim user must be social-engineered into clicking or following a specially crafted URL containing the malicious header_format value (UI:R per CVSS). Without this user interaction, the reflected payload does not execute. High-value targets are privileged WordPress accounts (administrators, editors) whose session context would yield the most impactful post-exploitation capability. The shortcode code path is not exploitable via this vector because it does apply wp_kses(); only the AJAX path is affected.

The CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C accurately reflects the real-world risk profile. The network-accessible attack surface and absence of any authentication requirement lower the attacker's barrier considerably compared to typical reflected-XSS issues, while the mandatory user interaction (UI:R) remains the primary limiting factor - exploitation depends entirely on social-engineering a victim into clicking a crafted URL. The scope change (S:C) is appropriate: the injected script executes in the victim's browser session, enabling session cookie theft, credential harvesting, or authenticated CSRF-style actions on behalf of the victim. No EPSS data was provided in the source intelligence; no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis. No public POC code was referenced. Overall real-world risk is moderate: the unauthenticated AJAX vector removes the common 'attacker needs an account' barrier found in many WordPress XSS issues, but realistic attack volume is constrained by the phishing prerequisite.

An attacker crafts a URL targeting the target WordPress site's admin-ajax.php endpoint with action=search_events_grouped and a header_format parameter containing a JavaScript payload such as a cookie-exfiltration script. The attacker delivers this URL to a privileged WordPress user - such as an administrator or editor - via phishing email, forum post, or malicious redirect. When the victim clicks the link, their browser executes the injected script in the context of the WordPress site, potentially exfiltrating session cookies or performing authenticated actions on the victim's behalf. No public POC was identified at time of analysis.