EUVD-2026-53886
GHSA-c5hq-cvjf-ggw4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-accessible unauthenticated XSS with scope change justifies AV:N/PR:N/S:C; A:N applied because XSS does not meaningfully affect service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 versions.
AnalysisAI
Unauthenticated cross-site scripting (XSS) in the Events Manager WordPress plugin versions 7.4.1 and earlier enables remote attackers without credentials to inject arbitrary JavaScript into pages rendered for other users. The CVSS 7.1 score is driven by a scope change (S:C), meaning injected scripts execute in victims' browsers outside the plugin's security context - enabling session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users including administrators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS vector PR:N confirms the injection point is publicly accessible without credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score is elevated primarily by the scope change (S:C) and the unauthenticated, network-accessible attack vector (AV:N/AC:L/PR:N), making this more exploitable than a typical medium-severity finding. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted event entry or manipulates a URL parameter containing a malicious JavaScript payload through a public-facing Events Manager form on a target WordPress site. When an administrator or authenticated user subsequently views the event listing or processes the submission, the injected script executes in their browser - exfiltrating session cookies, WordPress nonce tokens, or authentication credentials to an attacker-controlled endpoint. … |
| Remediation | Update the Events Manager WordPress plugin to a version higher than 7.4.1 as soon as one is available; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/events-manager/vulnerability/wordpress-events-manager-plugin-7-4-1-cross-site-scripting-xss-vulnerability should be consulted for the confirmed fixed release, as no specific patched version number was independently confirmed in the available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running Events Manager plugin versions 7.4.1 and earlier through the plugin admin panel or wp-admin interface, and immediately disable the plugin on all affected systems to remove the attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Events Manager
View allThe Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injecti
Privilege escalation and account takeover in the Events Manager WordPress plugin before 7.4.1 lets unauthenticated attac
SQL injection in the Events Manager WordPress plugin (versions before 7.4.1) allows any subscriber-level or higher authe
Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malici
Events Manager WordPress plugin before version 7.4 exposes an unauthenticated REST API endpoint that serves temporarily
The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper
The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Go
PHP Object Injection in the WordPress Events Manager plugin (Marcus/@msykes) affects all versions up to and including 7.
Missing Authorization vulnerability in Pixelite Events Manager.4.6.4. Rated high severity (CVSS 8.8), this vulnerability
The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plu
The Events Manager - Calendar, Bookings, Tickets, and more!. Rated high severity (CVSS 7.5), this vulnerability is remot
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today