CVE-2026-28162
HighCVSS 7.1Summary
Unauthenticated Cross Site Scripting (XSS) vulnerability in Events Made Easy versions up to 3.2.5.
Risk Assessment
An attacker can inject a malicious script that executes in the victim's browser, potentially leading to session theft or account takeover.
Recommendation
Update Events Made Easy to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Events Made Easy
See all- CVE-2026-59557Medium
The Events Made Easy plugin version 3.1.3 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to functions or data.
- CVE-2026-75963High
The Events Made Easy plugin for WordPress up to version 3.2.5 is vulnerable to Local File Inclusion via the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access to include and execute arbitrary .php files.
- CVE-2026-14842Medium
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged. This allows unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
- CVE-2026-14843Medium
The Events Made Easy WordPress plugin before version 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request. It relies only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.