Events Made Easy <= 3.3.5 - Unauthenticated Shortcode and Placeholder Injection via Booking, Membership and Task Signup Form Fields
- ID
- WPSEC-2026-2740
- Plugin
- Events Made Easy (events-made-easy)
- Affected
- all versions before 3.3.6
- Remediation
- Update to 3.3.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-1336
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- Events Made Easy on WPSec AttackSurface
- Fix released
- Published
Description
The Events Made Easy plugin for WordPress is vulnerable to Shortcode and Placeholder Injection via front-end booking, membership and task signup form fields in all versions up to, and including, 3.3.5, due to insufficient neutralization of shortcode ([...]) and placeholder (#_...) syntax in user-supplied values. Affected values include first and last names, booking, cancel and signup comments, custom form field answers, uploaded file names and discount codes. These values are inserted into booking, member and task templates, and the result is passed through do_shortcode(). This makes it possible for unauthenticated attackers to have arbitrary shortcodes and plugin placeholders run when their booking or member data is shown on confirmation pages or in emails. This can disclose data or trigger other shortcode functionality.
References
- https://wpsec.com/vuln/WPSEC-2026-2740/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.3.6/
- https://wordpress.org/plugins/events-made-easy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS