What is the CVSS score of CVE-2026-8898?

CVE-2026-8898 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Events In City CVE-2026-8898

EUVD-2026-32070 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-xfv5-wf8w-m5r8

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:30 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'org-events' shortcode in versions up to, and including, 3.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (such as 'organizer_id', 'width', 'height', 'transparency', 'header', 'border', and 'layout') in the org_event_scode() function. The attribute values are concatenated directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Events In City WordPress plugin (versions ≤3.0) allows contributor-level authenticated users to inject persistent JavaScript payloads via unsanitized 'org-events' shortcode attributes handled by the org_event_scode() function. The CVSS scope is Changed (S:C), meaning injected scripts execute in victims' browsers outside the plugin's own context, enabling session hijacking, credential theft, or unauthorized actions against any user who views an affected page. No public exploit identified at time of analysis; EPSS score of 0.03% (9th percentile) reflects low current exploitation likelihood, though the contributor-level access requirement is a realistic attack surface on multi-author WordPress sites.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause: the org_event_scode() function in ae_org_widget.php (lines 144 and 156 per Wordfence/NVD source references at plugins.trac.wordpress.org) concatenates user-supplied shortcode attributes - organizer_id, width, height, transparency, header, border, and layout - directly into HTML attribute output without invoking WordPress's built-in esc_attr() sanitization function. This is a classic output escaping failure in a WordPress shortcode handler. The 'stored' classification means the payload is persisted server-side (in post content) rather than reflected per-request, increasing impact because the attack executes against every subsequent visitor without further attacker involvement. No CPE string was provided in source data; affected product is the 'Events In City' WordPress plugin per ENISA EUVD-2026-32070.

RemediationAI

No vendor-released patch identified at time of analysis - the available references point only to the vulnerable version 3.0 source code and the Wordfence advisory, with no successor patched release confirmed. Monitor the Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/4281ad41-d9a4-4503-9238-24990641a9bf and the WordPress plugin repository for an updated release. As compensating controls pending a patch: first, audit and restrict contributor role assignments to only fully trusted users, since PR:L is the primary exploitation barrier - removing untrusted contributors eliminates the attack surface entirely. Second, deploy a Web Application Firewall rule (e.g., Wordfence's built-in firewall on affected sites) to block XSS patterns in shortcode attribute values; note this may produce false positives on legitimate organizer_id values. Third, if the org-events shortcode is not actively used, consider deactivating or uninstalling the Events In City plugin entirely until a patched version is released - this has no functional trade-off if the feature is unused.