WP Event Solution EUVD-2026-109246

Exploitation requires an actor able to store input that WP Event Solution later renders without proper neutralization, and a second user (UI:R) must subsequently view the affected page for the payload to execute. The supplied vector lists PR:N, but the specific field, capability level and whether a WordPress account is needed are NOT described in the available sources and should be confirmed with Patchstack; if authenticated submission is in fact required, that meaningfully limits exploitation. Limiting factors: mandatory victim interaction (viewing the malicious page) and dependence on the plugin being installed and the vulnerable content path being reachable. Affected versions are from an unspecified start through 4.1.26.

This is a moderate, not emergency, priority. The signals are mixed and some are missing. The CVSS 3.1 base score of 7.1 is driven largely by the scope-change (S:C) and the network vector (AV:N/AC:L), reflecting the fact that injected script executes in the victim's browser context rather than reflecting a highly damaging primitive - the actual confidentiality, integrity and availability impacts are all rated Low. The Patchstack-supplied vector lists PR:N (unauthenticated), but stored XSS in WordPress plugins commonly requires at least an authenticated low-privilege account (e.g. contributor/subscriber) able to submit content that is later rendered; the available sources do not describe the exact injection point, so the PR:N rating should be verified against the Patchstack advisory before treating this as fully unauthenticated. UI:R confirms a second actor (typically an administrator or another user) must view the malicious page for the payload to fire. There is NO EPSS score, NO CISA KEV listing, and NO confirmed public exploit in the provided data - the single reference is the Patchstack database entry (an advisory, not verified working exploit code). The vuln.today decision label is 'this_week', consistent with a real-but-not-critical issue warranting prompt patching rather than emergency response. In short: a legitimate stored-XSS flaw worth remediating this week, but the absence of EPSS/KEV/POC signals and the Low impact metrics argue against treating it as an actively-exploited crisis.

An attacker with the ability to submit content handled by WP Event Solution (for example event details or another plugin-rendered field) stores a malicious JavaScript payload that is not properly neutralized. When an administrator or other user later views the affected page in wp-admin or on the front end, the script executes in their browser session, potentially performing actions such as session/cookie theft or administrative actions on their behalf. No public exploit identified at time of analysis; the exact injection field is not described in the available sources.