Vulnerabilities / Quick Event Manager / WPSEC-2026-1866
Quick Event Manager <= 9.18 - Unauthenticated Stored Cross-Site Scripting via Registration User Field
Medium 6.1
CWE-79Fixed in 9.19
- ID
- WPSEC-2026-1866
- Plugin
- Quick Event Manager (quick-event-manager)
- Affected
- all versions before 9.19
- Remediation
- Update to 9.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-28
- Attack surface
- Quick Event Manager on WPSec AttackSurface
- Fix released
- Published
Description
The Quick Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first user-defined registration field ('yourblank1'), which is shown as the [website] link in the public attendee list, in all versions up to, and including, 9.18. This is due to the plugin putting the value into the link's href attribute without URL validation or escaping, so javascript: URLs are kept. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the attendee's link on the event page.
References
- https://wpsec.com/vuln/WPSEC-2026-1866/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19/
- https://wordpress.org/plugins/quick-event-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS