{
 "id": "WPSEC-2026-1225",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1225/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1225/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1225/index.md",
 "title": "Events Made Easy <= 3.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event HTML Headers and Schema.org JSON-LD",
 "description": "The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event meta headers and schema.org JSON-LD block on single event pages in all versions up to, and including, 3.2.24, due to insufficient output escaping. Event placeholders such as the event name, excerpt and location fields were expanded in 'text' mode, which decodes HTML entities, after the JSON had been encoded, and the result was printed unescaped inside a <script type=\"application/ld+json\"> element. A free-text 'performer' custom field answer was also added without escaping '<' or '/'. This makes it possible for authenticated attackers with contributor-level access and above (the default capability for adding events), and for unauthenticated visitors when guest frontend event submission is enabled, to inject arbitrary web scripts that run whenever a user visits the published event page.",
 "plugin": {
  "slug": "events-made-easy",
  "name": "Events Made Easy",
  "full_name": "Events Made Easy",
  "wordpress_org": "https://wordpress.org/plugins/events-made-easy/",
  "advisories_url": "https://wpsec.com/vuln/plugin/events-made-easy/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/events-made-easy"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.2.25",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.2.25"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.2.25",
 "remediation": "Update to 3.2.25 or later.",
 "fix_released": "2026-10-17T13:11:03+00:00",
 "published": "2026-10-18T13:43:00+00:00",
 "updated": "2026-10-18T11:09:28.499979+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1225/",
  "https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.25/",
  "https://wordpress.org/plugins/events-made-easy/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/events-made-easy",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-18"
 }
}