EUVD-2026-65277
GHSA-gg76-jx66-hjq8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated AJAX endpoint justifies PR:N and AV:N; reflected XSS mandates UI:R; injected script runs in victim browser context (S:C); no availability impact applies.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The shortcode entry point sanitizes 'header_format' via wp_kses(), but the unauthenticated 'search_events_grouped' AJAX action bypasses this sanitization entirely, leaving the parameter unsanitized before it is echoed into the HTML body in output_grouped().
AnalysisAI
Reflected Cross-Site Scripting in the Events Manager WordPress plugin (all versions up to and including 7.4.0.1) allows unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The attack surface is the plugin's unauthenticated 'search_events_grouped' AJAX action, which accepts the 'header_format' parameter and passes it to output_grouped() without sanitization - bypassing the wp_kses() protection applied only at the shortcode entry point. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Events Manager plugin must be installed and active on the target WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C accurately reflects the real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (changeset); patched version 7.4.1 is inferred from the WordPress Plugin Trac changeset comparing 7.4.0.1 to 7.4.1 at https://plugins.trac.wordpress.org/changeset?old_path=/events-manager/tags/7.4.0.1&new_path=/events-manager/tags/7.4.1, but this has not been independently verified against the official WordPress plugin repository release channel - confirm availability before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level
Second-order SQL injection in the Events Manager WordPress plugin (all versions through 7.4.0) allows authenticated cont
Authorization bypass in the Events Manager WordPress plugin (versions up to and including 7.4.0) exposes restricted even
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today