Cross-Site Scripting Vulnerability in Fullworks Plugins Display Eventbrite Events Widget
CVE-2026-123480

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Display Eventbrite Events
Vendor
CVE Published:
11 November 2026

What is CVE-2026-123480?

The Display Eventbrite Events widget for Fullworks Plugins suffers from an improper neutralization of input during web page generation, leading to a stored Cross-Site Scripting (XSS) vulnerability. This flaw allows an attacker to inject malicious scripts into content that is subsequently displayed to users. Affected versions include all releases from an unknown version through 6.9.1. This vulnerability could result in unauthorized actions being executed on behalf of users, compromising the security of the website.

Affected Version(s)

Display Eventbrite Events 0 <= 6.9.1

References

https://patchstack.com/database/wordpress/plugin/widget-f...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Oly Hossen | Patchstack Bug Bounty Program
.