{
 "id": "WPSEC-2026-1866",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1866/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1866/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1866/index.md",
 "title": "Quick Event Manager <= 9.18 - Unauthenticated Stored Cross-Site Scripting via Registration User Field",
 "description": "The Quick Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first user-defined registration field ('yourblank1'), which is shown as the [website] link in the public attendee list, in all versions up to, and including, 9.18. This is due to the plugin putting the value into the link's href attribute without URL validation or escaping, so javascript: URLs are kept. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the attendee's link on the event page.",
 "plugin": {
  "slug": "quick-event-manager",
  "name": "Quick Event Manager",
  "full_name": "Quick Event Manager",
  "wordpress_org": "https://wordpress.org/plugins/quick-event-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/quick-event-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/quick-event-manager"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.19",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.19"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.19",
 "remediation": "Update to 9.19 or later.",
 "fix_released": "2026-10-27T19:03:52+00:00",
 "published": "2026-10-28T19:48:30+00:00",
 "updated": "2026-10-28T09:11:54.258517+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1866/",
  "https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19/",
  "https://wordpress.org/plugins/quick-event-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/quick-event-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-28"
 }
}