Events Manager EUVD-2026-109256

Exploitation requires the attacker to deliver a crafted link to a victim and for that victim to click it while visiting the affected site (UI:R), limiting this to social-engineering-driven, one-victim-at-a-time attacks rather than automated mass exploitation. No authentication is required of the attacker (PR:N), and it is network-reachable against sites running Events Manager version 7.4.8 or earlier. The precise vulnerable parameter, page, or configuration is not described in the available sources, so it cannot be confirmed whether a specific plugin feature must be enabled; impact is maximized when the clicking victim is an authenticated administrator. The dependence on victim interaction is the primary factor limiting real-world risk.

This is a reflected cross-site scripting flaw (CWE-79) in the Events Manager WordPress plugin, reported by Patchstack and assigned the vuln.today priority label 'this_week'. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity issue requiring no attacker privileges (PR:N, i.e. unauthenticated) but mandating victim interaction (UI:R) - consistent with reflected XSS, where a target must follow an attacker-crafted link. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no confirmed proof-of-concept or working exploit code is referenced; the only reference is the Patchstack advisory itself, which is a vulnerability catalog entry rather than exploit code. Net assessment: a genuine but interaction-gated, moderate-severity web client-side vulnerability rather than a mass-exploitable server-side RCE. The 'this_week' label reflects worth-patching urgency for a widely-used plugin, not emergency active exploitation. Note one tension worth verifying: the input assigns A:L (availability impact) and S:C (scope change), which are atypical for a simple reflected XSS and appear to follow Patchstack's scoring convention; my independent assessment below treats availability as N.

An attacker crafts a URL to a vulnerable Events Manager endpoint containing a malicious script payload in a reflected parameter, then lures a logged-in site administrator or visitor into clicking it (e.g. via phishing email or a link on another site). When the victim's browser loads the page, the unsanitized input is reflected into the response and the script executes in their session context, enabling actions such as cookie/session theft or admin-panel actions. No public working exploit code is identified at time of analysis, though the trigger mechanism is a classic reflected-parameter injection; the exact vulnerable parameter is not described in the available sources.