# Events Made Easy <= 3.3.5 - Unauthenticated Shortcode and Placeholder Injection via Booking, Membership and Task Signup Form Fields

- **ID:** WPSEC-2026-2740
- **Plugin:** Events Made Easy (`events-made-easy`), https://wordpress.org/plugins/events-made-easy/
- **Affected versions:** all versions before 3.3.6
- **Fixed in:** 3.3.6 (Update to 3.3.6 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1336
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/events-made-easy
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2740/

## Description

The Events Made Easy plugin for WordPress is vulnerable to Shortcode and Placeholder Injection via front-end booking, membership and task signup form fields in all versions up to, and including, 3.3.5, due to insufficient neutralization of shortcode ([...]) and placeholder (#_...) syntax in user-supplied values. Affected values include first and last names, booking, cancel and signup comments, custom form field answers, uploaded file names and discount codes. These values are inserted into booking, member and task templates, and the result is passed through do_shortcode(). This makes it possible for unauthenticated attackers to have arbitrary shortcodes and plugin placeholders run when their booking or member data is shown on confirmation pages or in emails. This can disclose data or trigger other shortcode functionality.

## References

- https://wpsec.com/vuln/WPSEC-2026-2740/
- https://plugins.svn.wordpress.org/events-made-easy/tags/3.3.6/
- https://wordpress.org/plugins/events-made-easy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2740/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.