Description

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values (using only `wp_unslash()` without sanitization) and lack of output escaping when rendering the '#_ATT{key}' placeholder. This makes it possible for authenticated attackers, with Author-level access and above, or unauthenticated attackers when anonymous event submissions are enabled, to inject arbitrary web scripts that execute when any user views the affected event page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-05T06:17:09.017Z",
  "pubdate": "2026-09-05T06:17:09.017Z",
  "executiveSummary": "The Events Manager plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 7.3.3.\nThe flaw originates from inadequate input sanitization and a subsequent failure to implement output escaping within the event attribute management functionality.\nSuccessful exploitation allows an adversary to inject malicious JavaScript payloads into event attribute fields. These payloads execute automatically in the context of a victim's browser when they access the affected event page.\nThis vulnerability poses a significant security risk, as it permits unauthorized script execution, potential session hijacking, administrative credential theft, and unauthorized actions performed on behalf of authenticated users.\nExploitation can be conducted by users possessing Author-level privileges or higher. Furthermore, if the plugin is configured to permit anonymous event submissions, the attack surface expands to include unauthenticated remote attackers.\nThe vulnerability underscores a critical failure in the application's data handling lifecycle, specifically the absence of secure coding practices regarding input validation and output encoding.",
  "technicalDetails": "The root cause of this vulnerability is a dual-layered failure in the handling of event attributes. During the input phase, the plugin utilizes wp_unslash() on user-provided attribute values without applying appropriate sanitization filters, such as sanitize_text_field() or esc_attr(). This allows the submission of arbitrary characters, including HTML tags and script elements, directly into the database.\nThe second component of the vulnerability occurs during the rendering phase. When the plugin processes the '#_ATT{key}' placeholder to display event attributes on the front-end, it fails to perform necessary output escaping. By omitting functions like esc_js(), esc_html(), or wp_kses_post() during the generation of the HTML response, the browser interprets the stored malicious input as active content rather than plain text.\nThe attack flow proceeds as follows: An attacker with Author-level access navigates to the event creation or editing interface within the WordPress dashboard. They proceed to inject a malicious script payload (e.g., <script>alert(document.cookie)</script>) into one of the custom event attribute fields. The application accepts this input and persists it into the database.\nWhen a victim, such as a site administrator or a regular user, views the public-facing event page where the '#_ATT{key}' placeholder is utilized, the application retrieves the unsanitized payload from the database and embeds it directly into the HTML source. The victim's browser, upon rendering the page, executes the malicious JavaScript payload in the victim's security context.\nThe impact of this execution is extensive. Because the script executes within the session of the user viewing the page, an attacker can perform actions that the victim is authorized to conduct, such as modifying plugin settings, creating new administrator accounts, or exfiltrating sensitive session tokens (e.g., PHPSESSID or WordPress authentication cookies) to an attacker-controlled server. If the victim is an administrator, the compromise may lead to full site takeover.\nThis vulnerability is present in all versions through 7.3.3 and requires no complex exploitation techniques, as the injection point is accessible through standard plugin functionality. The vulnerability is effectively a classic Stored XSS vector arising from the lack of contextual output encoding."
}