Events Made Easy <= 3.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event HTML Headers and Schema.org JSON-LD
- ID
- WPSEC-2026-1225
- Plugin
- Events Made Easy (events-made-easy)
- Affected
- all versions before 3.2.25
- Remediation
- Update to 3.2.25 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-18
- Attack surface
- Events Made Easy on WPSec AttackSurface
- Fix released
- Published
Description
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event meta headers and schema.org JSON-LD block on single event pages in all versions up to, and including, 3.2.24, due to insufficient output escaping. Event placeholders such as the event name, excerpt and location fields were expanded in 'text' mode, which decodes HTML entities, after the JSON had been encoded, and the result was printed unescaped inside a <script type="application/ld+json"> element. A free-text 'performer' custom field answer was also added without escaping '<' or '/'. This makes it possible for authenticated attackers with contributor-level access and above (the default capability for adding events), and for unauthenticated visitors when guest frontend event submission is enabled, to inject arbitrary web scripts that run whenever a user visits the published event page.
References
- https://wpsec.com/vuln/WPSEC-2026-1225/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.25/
- https://wordpress.org/plugins/events-made-easy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS