# Quick Event Manager <= 9.18 - Unauthenticated Stored Cross-Site Scripting via Registration User Field

- **ID:** WPSEC-2026-1866
- **Plugin:** Quick Event Manager (`quick-event-manager`), https://wordpress.org/plugins/quick-event-manager/
- **Affected versions:** all versions before 9.19
- **Fixed in:** 9.19 (Update to 9.19 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/quick-event-manager
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1866/

## Description

The Quick Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first user-defined registration field ('yourblank1'), which is shown as the [website] link in the public attendee list, in all versions up to, and including, 9.18. This is due to the plugin putting the value into the link's href attribute without URL validation or escaping, so javascript: URLs are kept. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the attendee's link on the event page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1866/
- https://plugins.svn.wordpress.org/quick-event-manager/tags/9.19/
- https://wordpress.org/plugins/quick-event-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1866/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.