What is the CVSS score of CVE-2026-6268?

CVE-2026-6268 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of EventPress are affected by CVE-2026-6268?

The EventPress WordPress theme (versions before 22.2) contains a cross-site scripting vulnerability that can be exploited to hijack administrator sessions and execute unauthorized actions in the…. A patch is available.

How to fix or mitigate CVE-2026-6268?

Within 24 hours: Identify and catalog all WordPress installations using the EventPress theme. Within 7 days: Upgrade all affected installations to EventPress theme version 22.2 or later. Within 30 days: Verify successful upgrades on all systems, review administrator access logs for suspicious activity, and assess any potential unauthorized administrative actions.

EventPress CVE-2026-6268

EUVD-2026-32097 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 contact@wpscan.com

GHSA-2m2r-cm3x-6c7x

XSS WordPress

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:41 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

CVE Published

May 27, 2026 - 07:16 nvd

HIGH 7.1

DescriptionCVE.org

The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.

AnalysisAI

Reflected cross-site scripting in the EventPress WordPress theme (all versions before 22.2) lets unauthenticated attackers inject arbitrary JavaScript by abusing the unsanitized 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler, which echoes the value back into the response without escaping. An attacker who lures a logged-in user (typically an administrator working in the Customizer/admin context) to a crafted link executes script in that user's session, enabling actions such as session/cookie theft or admin-context operations. EPSS exploitation probability is very low (0.05%, 17th percentile), there is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw lives in a WordPress theme AJAX endpoint registered through WordPress's admin-ajax.php mechanism (the eventpress_customizer_notify_dismiss_action handler, tied to the theme Customizer's notification-dismiss feature). User-supplied input via the 'id' request parameter is reflected directly into the HTTP response body without sanitization or output escaping, the textbook root cause of CWE-79 (Improper Neutralization of Input During Web Page Generation). Because WordPress AJAX actions prefixed with wp_ajax_nopriv_ are reachable without authentication, the handler is exposed to anonymous requests, and the absence of an escaping function (e.g., esc_html/esc_attr) on output is what turns reflected input into executable markup in the victim's browser.

RemediationAI

Vendor-released patch: 22.2 - update the EventPress theme to version 22.2 or later, which adds the missing sanitization/escaping on the reflected 'id' value. Consult the WPScan advisory at https://wpscan.com/vulnerability/77192aeb-8e4b-4057-b5d7-2b95da634edd/ for confirmation of the fixed release. If immediate upgrade is not possible, deploy compensating controls: place a WAF rule to block or strip script-like payloads and angle brackets in the 'id' parameter on requests to admin-ajax.php for the eventpress_customizer_notify_dismiss_action action (trade-off: may break the legitimate dismiss feature and can be bypassed by encoding tricks), and restrict access to /wp-admin/ and admin-ajax.php by IP allowlisting where feasible (trade-off: hampers remote administrators). Reflected XSS still requires tricking an authenticated user, so reinforce admin awareness about clicking untrusted links and consider a strict Content-Security-Policy that disallows inline script (trade-off: may interfere with plugins/themes that rely on inline JavaScript).