Themify Event Post CVE-2026-32449

The CVSS 3.1 score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-accessible, low-complexity exploitation requiring low privileges and user interaction, with cross-site scope impact. The requirement for authenticated access (PR:L) significantly reduces attack surface compared to unauthenticated XSS vulnerabilities; however, many WordPress installations have contributor or author-level users who could exploit this. The UI:R requirement means a victim must view the injected content, but on a blog or event site, this is highly probable. Without EPSS score or KEV status data provided, the real-world prioritization depends on deployment context: WordPress sites with many low-privilege users face higher risk. The Medium CVSS score combined with storage persistence makes this a priority for patching, especially for public-facing WordPress installations, but it is not as critical as an unauthenticated remote code execution vulnerability.

An authenticated attacker with WordPress Author or Contributor privileges crafts a malicious event post title or description containing JavaScript code (e.g., stealing session cookies or redirecting to a phishing page). The plugin stores this input without sanitization, and when legitimate site visitors or administrators view the event listing or details page, the injected script executes in their browsers with the site's origin privileges. If the victim is a site administrator, the attacker could steal administrative session tokens, modify site content, or install backdoors. No user interaction beyond viewing the page is required from the victim's perspective, making this a high-probability attack in environments with many low-privilege content creators.