CVE-2026-118634
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Events Made Easy plugin for WordPress in versions up to and including 3.3.1 is vulnerable to stored cross-site scripting via the 'width' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.
Risk Assessment
Injected scripts can execute in users' browsers, enabling session theft, account takeover, or other actions in the victim's context.
Recommendation
Update the Events Made Easy plugin to a version later than 3.3.1. Until then, restrict contributor roles and review content for suspicious scripts.
Other vulnerabilities in Events Made Easy
See all- CVE-2026-107649Medium
The Events Made Easy plugin for WordPress (versions up to and including 3.2.22) is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. This vulnerability is only exploitable when both the guest event submission feature (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) are explicitly enabled by a site administrator, as both settings default to off.
- CVE-2026-28162High
Unauthenticated Cross Site Scripting (XSS) vulnerability in Events Made Easy versions up to 3.2.5.
- CVE-2026-75963High
The Events Made Easy plugin for WordPress up to version 3.2.5 is vulnerable to Local File Inclusion via the eme_single_event_page_template function, allowing authenticated attackers with contributor-level access to include and execute arbitrary .php files.
- CVE-2026-14842Medium
The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged. This allows unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.
- CVE-2026-14843Medium
The Events Made Easy WordPress plugin before version 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request. It relies only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.
- CVE-2026-59557Medium
The Events Made Easy plugin version 3.1.3 and earlier contains an unauthenticated broken access control vulnerability. An attacker without authentication can gain unauthorized access to functions or data.
Original NVD description (English source)
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS