Events Made Easy CVE-2026-28162

The attacker requires no authentication - exploitation is available to any unauthenticated network actor (PR:N per CVSS vector). A victim with an active browser session must interact with attacker-controlled content (UI:R), meaning the attack is not fully passive. The specific plugin endpoint or parameter that fails to sanitize input is not named in the available data; the exact vulnerable input vector should be confirmed via the Patchstack advisory. Exploitation is limited to environments where the Events Made Easy plugin (version 3.2.5 or earlier) is installed and active on a WordPress site. There is no indication that a non-default configuration is required - the vulnerability appears to exist in standard plugin operation.

The CVSS base score of 7.1 (High) is driven primarily by the network attack vector, low complexity, no required privileges, and the scope change to the victim's browser context. The mandatory user interaction (UI:R) is the principal limiting factor - exploitation requires a victim to load or interact with attacker-crafted content, reducing opportunistic mass exploitation. No EPSS data was provided in the source intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The Patchstack report provides credible sourcing but no POC was disclosed. Real-world risk is moderate: the plugin targets WordPress sites managing public events, where event-related pages are often publicly accessible and interaction-enticing, making social engineering to trigger UI:R feasible. Even a small municipal or community organization running this plugin on a public-facing site could expose administrator sessions to hijacking if a crafted link is clicked.

An attacker crafts a URL pointing to an Events Made Easy plugin endpoint that embeds a malicious JavaScript payload in an unescaped parameter. The attacker delivers this link to a logged-in WordPress administrator via phishing email or a compromised event listing. When the administrator's browser renders the page, the injected script executes in their session context, exfiltrating their session cookie or performing unauthorized admin actions on the WordPress site.