Quick Event Manager CVE-2026-84848

No authentication against the WordPress site is required to inject the malicious payload (PR:N confirmed by CVSS vector). However, successful exploitation depends on an authenticated WordPress user - typically an administrator or editor - loading a page or URL containing the attacker's injected payload (UI:R confirmed by CVSS), meaning social engineering or phishing is a necessary step. The scope change (S:C) indicates the injected script executes in the victim's browser outside the plugin's own security boundary, potentially affecting the entire WordPress admin session. Sites where no authenticated users browse front-end event pages, or where public event submission is disabled, present a reduced exploitation surface. Non-default plugin configurations that restrict public form input or apply additional output encoding would limit but not eliminate risk.

The CVSS 7.1 score is a reasonable characterization of an unauthenticated, network-reachable XSS with scope change. The UI:R metric is the most important limiting factor - exploitation is not fully automated and depends on a victim with a live WordPress session loading attacker-influenced content, which meaningfully constrains mass exploitation. Even a mid-sized municipal IT team in leszno running a community event site should treat this as a routine but non-emergency patch priority rather than a crisis response. The A:L availability metric in the vendor-supplied CVSS is atypical for pure XSS; standard XSS does not directly impair availability, and this metric may reflect edge-case script-induced page disruption rather than a genuine DoS path - this discrepancy is noted in the assessed vector below. EPSS data is absent from the available intelligence, preventing quantitative comparison of exploitation likelihood against peer vulnerabilities. No KEV listing and no POC are identified, placing this firmly in the 'patch on next cycle' tier for most organizations, with elevated urgency for sites where administrators regularly browse front-end event pages.

An unauthenticated attacker identifies a public WordPress site running Quick Event Manager ≤ 9.17, then crafts a URL or form submission embedding a JavaScript payload in an unsanitized event field. The attacker delivers this link to a logged-in WordPress administrator via phishing; when the administrator loads the page, the script executes in their browser, exfiltrates their session cookie to an attacker-controlled server, and enables full administrative takeover of the WordPress site. No public proof-of-concept has been identified, but the unauthenticated injection point and low attack complexity lower the barrier to exploitation once the vulnerable parameter is identified.