Stored Cross-Site Scripting Vulnerability in Event Organiser Plugin for WordPress
CVE-2026-2387

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Event Organiser
Vendor
CVE Published:
1 July 2026

What is CVE-2026-2387?

The Event Organiser plugin for WordPress is susceptible to a stored cross-site scripting issue that arises from the 'eo_events' shortcode. This vulnerability enables authenticated users with Contributor-level access or higher to inject malicious web scripts into event listings. These scripts, if executed by other users visiting the impacted event pages, can lead to unauthorized actions on behalf of the victim. The issue is present in all versions up to and including 3.12.9, stemming from insufficient handling of user input. Proper output escaping is necessary to mitigate the risk associated with this vulnerability.

Affected Version(s)

Event Organiser 0 <= 3.12.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3589132/even...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ
.