Events Made Easy <= 3.2.24 - Authenticated (Editor+) Stored Cross-Site Scripting via Location Name and Address in Location Edit Map
- ID
- WPSEC-2026-1224
- Plugin
- Events Made Easy (events-made-easy)
- Affected
- all versions before 3.2.25
- Remediation
- Update to 3.2.25 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-18
- Attack surface
- Events Made Easy on WPSec AttackSurface
- Fix released
- Published
Description
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the location name and address fields in all versions up to, and including, 3.2.24, due to insufficient output escaping. The location edit map reads these values from the form inputs, where HTML entities left in the stored value are decoded, and joins them into an HTML string that is passed to Leaflet's bindPopup. This makes it possible for authenticated attackers with the plugin's location creation capability (Editor-level by default), and for contributors or unauthenticated visitors when the frontend submission form's "Force location creation" option is enabled, to inject arbitrary web scripts that run when an administrator or editor opens the edit map for that location or event.
References
- https://wpsec.com/vuln/WPSEC-2026-1224/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.25/
- https://wordpress.org/plugins/events-made-easy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS