Cross-Site Scripting Vulnerability in Arraytics WP Event Solution Plugin
CVE-2026-112844

7.1HIGH

Key Information:

Vendor

WordPress
Status
WP Event Solution
Vendor
CVE Published:
24 October 2026

What is CVE-2026-112844?

The WP Event Solution plugin by Arraytics has a vulnerability that allows for improper neutralization of user input during web page generation. This leads to a Stored XSS attack vector, which means that malicious scripts can be stored and executed within the application, potentially allowing attackers to steal sensitive information or take control of user sessions. This vulnerability affects versions up to 4.1.26, emphasizing the need for users to review their installations and apply updates.

Affected Version(s)

WP Event Solution 0 <= 4.1.26

References

https://patchstack.com/database/wordpress/plugin/wp-event...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dthangws | Patchstack Bug Bounty Program
.