EUVD-2026-64793
GHSA-v855-pjx5-8m6f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS exploits browser context (S:C, C:L, I:L) but does not cause server-side availability impact, so A:N rather than A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
AnalysisAI
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker requires no authentication - exploitation is available to any unauthenticated network actor (PR:N per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.1 (High) is driven primarily by the network attack vector, low complexity, no required privileges, and the scope change to the victim's browser context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix availability should be verified via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/events-made-easy/vulnerability/wordpress-events-made-easy-plugin-3-2-5-cross-site-scripting-xss-vulnerability - no specific patched version number was confirmed in the available input data, so administrators should check the WordPress plugin repository for a release newer than 3.2.5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running Events Made Easy plugin versions ≤3.2.5 and either remove the plugin entirely or isolate affected systems if operationally essential. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Events Made Easy
View allThe Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in
The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in
Unauthenticated data overwrite in the Events Made Easy WordPress plugin (all versions before 3.1.4) allows any remote, u
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privi
Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenti
Missing authorization in the Events Made Easy plugin for WordPress up to version 3.1.3 permits unauthenticated remote at
The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on sev
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today