What is the CVSS score of CVE-2026-2387?

CVE-2026-2387 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Event Organiser CVE-2026-2387

EUVD-2026-40904 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 Wordfence

GHSA-fmmj-9298-j37p

WordPress XSS Wordpress Plugin Event Organiser

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Stored XSS with Contributor auth (PR:L) fires on normal page visit; Changed Scope reflects browser-context execution; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:28 vuln.today

CVE Published

Jul 01, 2026 - 04:32 nvd

MEDIUM 6.4

DescriptionCVE.org

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_events' shortcode accepting attacker-controlled 'no_events' content and rendering it in event list templates without output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Event Organiser WordPress plugin (all versions through 3.12.9) allows an authenticated attacker with Contributor-level access or higher to inject arbitrary JavaScript via the unescaped 'no_events' parameter of the 'eo_events' shortcode. The payload persists server-side and executes in any visitor's browser when they load a page containing the injected shortcode with no matching events. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low authentication bar (Contributor) makes this a meaningful risk on multi-author WordPress sites.

Technical ContextAI

The affected component is the Event Organiser plugin by Stephen Harris (CPE: cpe:2.3:a:stephenharris:event_organiser:*:*:*:*:*:*:*:*) - a WordPress plugin for managing calendar events. The root cause is CWE-79: Improper Neutralization of Input During Web Page Generation. Specifically, the 'eo_events' shortcode accepts a 'no_events' attribute that supplies fallback content rendered when no events match the query. The plugin passes this attacker-supplied value directly into event list templates without applying WordPress output escaping functions such as esc_html() or wp_kses(). Because WordPress grants Contributors the ability to embed shortcodes in posts and pages, any user at that trust level can author a page with this shortcode and supply a malicious 'no_events' value. The fix is committed to the WordPress plugin SVN at changeset 3589132.

RemediationAI

Update the Event Organiser plugin to the version that incorporates changeset 3589132 from the WordPress plugin SVN repository (https://plugins.trac.wordpress.org/changeset/3589132/event-organiser); this commit adds proper output escaping to the 'no_events' shortcode parameter. Check the plugin's changelog in the WordPress admin dashboard or at wordpress.org/plugins/event-organiser to confirm the exact patched version number, as it is not independently confirmed in the available intelligence. As a compensating control pending update, use a role-management plugin to strip Contributor-level users of the ability to publish posts or insert shortcodes; note this will disrupt normal contributor workflows. Alternatively, a Web Application Firewall rule blocking '<script' and common XSS payloads in POST bodies can reduce exposure without disrupting editorial workflows, though WAF bypasses are common and this is not a substitute for patching.