{
 "id": "WPSEC-2026-1224",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1224/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1224/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1224/index.md",
 "title": "Events Made Easy <= 3.2.24 - Authenticated (Editor+) Stored Cross-Site Scripting via Location Name and Address in Location Edit Map",
 "description": "The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the location name and address fields in all versions up to, and including, 3.2.24, due to insufficient output escaping. The location edit map reads these values from the form inputs, where HTML entities left in the stored value are decoded, and joins them into an HTML string that is passed to Leaflet's bindPopup. This makes it possible for authenticated attackers with the plugin's location creation capability (Editor-level by default), and for contributors or unauthenticated visitors when the frontend submission form's \"Force location creation\" option is enabled, to inject arbitrary web scripts that run when an administrator or editor opens the edit map for that location or event.",
 "plugin": {
  "slug": "events-made-easy",
  "name": "Events Made Easy",
  "full_name": "Events Made Easy",
  "wordpress_org": "https://wordpress.org/plugins/events-made-easy/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-made-easy/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-made-easy"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.2.25",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.2.25"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.2.25",
 "remediation": "Update to 3.2.25 or later.",
 "fix_released": "2026-10-17T13:11:03+00:00",
 "published": "2026-10-18T13:43:00+00:00",
 "updated": "2026-10-18T11:09:28.499979+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1224/",
  "https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.25/",
  "https://wordpress.org/plugins/events-made-easy/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-made-easy",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-18"
 }
}