Events Manager EUVD-2026-53886

No authentication is required - the CVSS vector PR:N confirms the injection point is publicly accessible without credentials. User interaction is required (UI:R): a victim, most likely an administrator or logged-in WordPress user, must visit or load a page containing the attacker's injected payload for the XSS to execute. The attack is network-accessible (AV:N) against any WordPress installation running Events Manager 7.4.1 or earlier with public-facing event pages enabled. Exploitation is limited by the need for victim interaction and the assumption that the Events Manager plugin exposes at least one unauthenticated input surface (such as a public event submission form or search field) for the initial payload injection step.

The CVSS 7.1 score is elevated primarily by the scope change (S:C) and the unauthenticated, network-accessible attack vector (AV:N/AC:L/PR:N), making this more exploitable than a typical medium-severity finding. However, UI:R (user interaction required) constrains impact - an attacker cannot achieve exploitation without a victim loading the affected page. No EPSS score was provided in the available intelligence, and no CISA KEV listing confirms active exploitation. No POC code is publicly documented at time of analysis. Real-world priority is moderate-to-high for sites with public-facing Events Manager pages: persistent XSS variants where attacker-controlled event data is stored and later rendered to administrators represent the most dangerous scenario, while reflected variants require social engineering. The A:L (low availability) impact in the vendor-supplied CVSS vector is atypical for pure XSS and may be over-scored - availability disruption from XSS is generally limited.

An attacker submits a crafted event entry or manipulates a URL parameter containing a malicious JavaScript payload through a public-facing Events Manager form on a target WordPress site. When an administrator or authenticated user subsequently views the event listing or processes the submission, the injected script executes in their browser - exfiltrating session cookies, WordPress nonce tokens, or authentication credentials to an attacker-controlled endpoint. No public POC has been identified, but the unauthenticated, low-complexity attack vector means any attacker familiar with basic XSS techniques can replicate this without specialized tooling.