Events Made Easy <= 3.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Location Map Balloons
- ID
- WPSEC-2026-1112
- Plugin
- Events Made Easy (events-made-easy)
- Affected
- all versions before 3.2.23
- Remediation
- Update to 3.2.23 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-16
- Attack surface
- Events Made Easy on WPSec AttackSurface
- Fix released
- Published
Description
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via location map balloon content in all versions up to, and including, 3.2.22. The map script entity-decodes the escaped balloon text (built from the balloon format and location fields such as the location name) and passes it to Leaflet as raw HTML, and the plugin's HTML sanitizer does not decode entities before removing tags, so entity-encoded markup survives. This makes it possible for authenticated attackers, with Contributor-level access and above (for example through the frontend event submission form, which allows contributors by default), to inject arbitrary web scripts that run whenever a user views a page with the affected map.
References
- https://wpsec.com/vuln/WPSEC-2026-1112/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.23/
- https://wordpress.org/plugins/events-made-easy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS