# Events Made Easy <= 3.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event HTML Headers and Schema.org JSON-LD

- **ID:** WPSEC-2026-1225
- **Plugin:** Events Made Easy (`events-made-easy`), https://wordpress.org/plugins/events-made-easy/
- **Affected versions:** all versions before 3.2.25
- **Fixed in:** 3.2.25 (Update to 3.2.25 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-made-easy
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1225/

## Description

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event meta headers and schema.org JSON-LD block on single event pages in all versions up to, and including, 3.2.24, due to insufficient output escaping. Event placeholders such as the event name, excerpt and location fields were expanded in 'text' mode, which decodes HTML entities, after the JSON had been encoded, and the result was printed unescaped inside a <script type="application/ld+json"> element. A free-text 'performer' custom field answer was also added without escaping '<' or '/'. This makes it possible for authenticated attackers with contributor-level access and above (the default capability for adding events), and for unauthenticated visitors when guest frontend event submission is enabled, to inject arbitrary web scripts that run whenever a user visits the published event page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1225/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.2.25/
- https://wordpress.org/plugins/events-made-easy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1225/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.