CVE-2026-112844
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WordPress plugin 'WP Event Solution' (versions up to 4.1.26) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. A malicious script stored in the database executes for users visiting the site.
Risk Assessment
Stored XSS can lead to user and admin account takeover, session data theft, and persistent site compromise. The risk is high because the script is stored and executed repeatedly.
Recommendation
Update the 'WP Event Solution' plugin to a version later than 4.1.26 or remove it. Inspect and clean the database for potentially injected scripts.
Other vulnerabilities in WP Event Solution
See all- CVE-2026-110380Medium
The WP Event Solution plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 4.1.26.
- CVE-2026-82223Medium
Unauthenticated Broken Access Control vulnerability in WP Event Solution versions up to 4.1.22. An attacker without authentication can bypass access controls.
- CVE-2026-109898Medium
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Event Solution: from n/a through 4.1.25.
- CVE-2026-97300Medium
The vulnerability allows unauthenticated broken access control in WP Event Solution versions up to 4.1.25.
- CVE-2026-105073Medium
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution allows retrieving embedded sensitive data. This issue affects WP Event Solution from n/a through 4.1.25.
- CVE-2026-103684Medium
Missing Authorization vulnerability in Arraytics WP Event Solution allows exploiting incorrectly configured access control security levels. This issue affects WP Event Solution from n/a through 4.1.25.
- CVE-2026-28174Medium
Sensitive data exposure vulnerability in WP Event Solution up to version 4.1.18 allows unauthorized access to customer data.
- CVE-2026-28173High
WP Event Solution plugin versions up to 4.1.19 contain a Customer Arbitrary Content Deletion vulnerability. A user with customer role can delete arbitrary content.
- CVE-2026-66451Medium
Broken Authentication vulnerability in WP Event Solution versions up to 4.1.9 allows an unauthenticated attacker to bypass authentication mechanisms.
- CVE-2025-68045High
The WordPress plugin WP Event Solution (up to version 4.1.12) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may let unauthorized users access functions or data they should not.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS