Reflected Cross-Site Scripting Vulnerability in EventPress Theme by WordPress
CVE-2026-6268
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 27 May 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-6268?
The EventPress WordPress theme prior to version 22.2 is susceptible to a reflected cross-site scripting vulnerability. This security lapse arises from the failure to sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before it is included in the response. This oversight enables unauthenticated attackers to potentially launch reflected XSS attacks targeting logged-in users, thereby compromising the security of the WordPress installation and exposing sensitive data.
Affected Version(s)
EventPress 0 < 22.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.