CVE-2026-17089
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Events Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in versions up to and including 7.4.0.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user clicks a crafted link.
Risk Assessment
The risk includes session hijacking, data theft, or unauthorized actions performed in the context of a logged-in administrator.
Recommendation
Immediately update the plugin to the latest patched version.
Other vulnerabilities in Events Manager
See all- CVE-2026-18366Critical
The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the plugin's own posts.
- CVE-2026-14280Medium
The Events Manager plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 7.3.7.4 via the em_options_save function. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server, leading to code execution or data exposure.
- CVE-2026-10627Medium
The Events Manager plugin for WordPress is vulnerable to authorization bypass in versions up to and including 7.4.0. Unauthenticated attackers can view titles, dates, descriptions, and location details of events and locations marked as draft, pending, trashed, or private.
- CVE-2026-15023Medium
The Events Manager plugin for WordPress up to version 7.4.0 is vulnerable to SQL injection via the 'meta_key' parameter in the event/location duplicate action. Attackers with contributor-level access can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-18057High
The Events Manager WordPress plugin before 7.4.1 does not sanitize and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
- CVE-2026-66457High
Unauthenticated Cross Site Scripting (XSS) in Events Manager versions up to 7.4.1.
- CVE-2026-12987High
The Events Manager WordPress plugin before version 7.3.7 unsafely handles booking-registration data on sites using No-User-Account Booking Mode. A booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query built without parameterization, so an unauthenticated attacker can read arbitrary database data (e.g., user password hashes, secret keys) when the booking is later loaded.
- CVE-2026-57713High
The Events Manager WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 7.3.6.
Original NVD description (English source)
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The shortcode entry point sanitizes 'header_format' via wp_kses(), but the unauthenticated 'search_events_grouped' AJAX action bypasses this sanitization entirely, leaving the parameter unsanitized before it is echoed into the HTML body in output_grouped().