CVE-2025-62042
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post. This issue affects Event post: from n/a through <= 5.10.3.
Risk Assessment
XSS attack may allow execution of malicious script in user's browser, theft of session cookies, or account takeover. May lead to website compromise.
Recommendation
Update Event post plugin to version higher than 5.10.3. If update is not possible, consider disabling the plugin.
Other vulnerabilities in Event post
See all- CVE-2026-107432Medium
The Event post plugin (up to version 6.1.1) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions they are not permitted to.
- CVE-2026-107427Medium
The Event post plugin (up to version 6.1.1) contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization by manipulating a user-controlled key. An attacker may gain access to resources or perform actions they are not authorized to.
- CVE-2026-65486Medium
The Event post plugin versions up to 6.0.1 contain an unauthenticated broken access control vulnerability. An attacker without authentication can bypass access control mechanisms.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.10.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS