Wpevently EUVD-2026-15685

Remote attacker crafts malicious URL containing XSS payload and sends to victim. Victim must click the link in WpEvently WordPress plugin versions <= 5.1.4. No authentication required. Reflected XSS attack exploiting improper input neutralization in web page generation.

While CVSS and EPSS scores are not provided, the risk can be assessed through available signals: the vulnerability is reported by Patchstack and tracked via EUVD ID EUVD-2026-15685, indicating formal recognition and documentation. Reflected XSS vulnerabilities typically have low to moderate attack complexity (requiring user interaction via link clicking) but high impact potential if successfully exploited, as they can compromise user sessions and enable account takeover. The absence of CVSS scoring prevents quantitative comparison, but reflected XSS in WordPress plugins is generally treated as a moderate-to-high priority given the large installed base of WordPress sites and the ease of exploitation. KEV status and POC availability are not documented in the provided intelligence, but the Patchstack report suggests the vulnerability has been analyzed and verified. Real-world risk depends on plugin adoption rates and whether automated scanning tools detect unpatched instances, making this a medium-priority vulnerability requiring timely patching but not critical-level emergency response.

An attacker crafts a malicious URL containing XSS payload in a query parameter (e.g., ?event=<script>alert('XSS')</script>) and tricks a WordPress site administrator or regular user into clicking the link via phishing email or forum post. When the user visits the link, the WpEvently plugin reflects the unsanitized payload directly into the HTML response, causing the browser to execute the injected JavaScript in the context of the victim's session. The attacker can then steal the user's WordPress session cookie, inject a backdoor admin account, or redirect the victim to a credential harvesting page, with success depending solely on the user clicking the crafted link.