# Events Made Easy <= 3.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via Location Map Balloons

- **ID:** WPSEC-2026-1112
- **Plugin:** Events Made Easy (`events-made-easy`), https://wordpress.org/plugins/events-made-easy/
- **Affected versions:** all versions before 3.2.23
- **Fixed in:** 3.2.23 (Update to 3.2.23 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-made-easy
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1112/

## Description

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via location map balloon content in all versions up to, and including, 3.2.22. The map script entity-decodes the escaped balloon text (built from the balloon format and location fields such as the location name) and passes it to Leaflet as raw HTML, and the plugin's HTML sanitizer does not decode entities before removing tags, so entity-encoded markup survives. This makes it possible for authenticated attackers, with Contributor-level access and above (for example through the frontend event submission form, which allows contributors by default), to inject arbitrary web scripts that run whenever a user views a page with the affected map.

## References

- https://wpsec.com/vuln/WPSEC-2026-1112/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.23/
- https://wordpress.org/plugins/events-made-easy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1112/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.