{"id":"CVE-2026-112844","kind":"vulnerability","aliases":["CVE-2026-112844"],"related":[],"title":"WP Event Solution WordPress plugin: stored XSS through 4.1.26","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.","summary":"The WP Event Solution WordPress plugin by Arraytics fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store malicious input in the plugin can run script in other users' browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-event-solution"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the WP Event Solution plugin in the WordPress admin under Plugins, or with `wp plugin get wp-event-solution --field=version`\n- Compare it against the affected range: versions through `4.1.26` are affected","fix":"- Update WP Event Solution to a version later than `4.1.26`, as published by the vendor (fixed version unknown from the sources)\n- If no fixed version is available, deactivate the plugin until one is released","status":"open","published_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T03:31:10+00:00","updated_at":"2026-10-25T03:31:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Event Solution to a version later than `4.1.26`, as published by the vendor (fixed version unknown from the sources)\n- If no fixed version is available, deactivate the plugin until one is released","reach":"internet","title":"WP Event Solution WordPress plugin: stored XSS through 4.1.26","impact":"medium","summary":"The WP Event Solution WordPress plugin by Arraytics fails to neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can store malicious input in the plugin can run script in other users' browsers.","category":"package","nicknames":[],"who_cares":["wordpress","wp-event-solution"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Confirm the first fixed version and whether low-privilege or unauthenticated users can store the payload; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112844.","how_to_check":"- Check the installed version of the WP Event Solution plugin in the WordPress admin under Plugins, or with `wp plugin get wp-event-solution --field=version`\n- Compare it against the affected range: versions through `4.1.26` are affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Event Solution plugin at version `4.1.26` or earlier are exposed. The stored script is delivered to visitors and administrators who view the affected event pages, so sites where the plugin is not installed can skip it. Whether an attacker needs a logged-in account depends on the plugin's input paths, which the sources do not state.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":3314,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112844':12A,15A '-2026':11A,14A '4.1.26':9A,94C 'affect':87C 'allow':38B,83C 'arrayt':29B,75C 'attack':45B 'browser':60B 'cross':41B,70C 'cross-sit':40B,69C 'cve':10A,13A 'event':2A,20B,24B,77C,81C,89C 'fail':30B 'generat':35B,68C 'improp':61C 'input':33B,50B,64C 'issu':86C 'malici':49B 'n/a':92C 'neutral':32B,62C 'packag':16B 'page':37B,67C 'plugin':5A,27B,53B 'run':55B 'script':43B,56B,72C 'site':42B,71C 'solut':3A,21B,25B,78C,82C,90C 'store':6A,39B,48B,84C 'user':59B 'vulner':73C 'web':36B,66C 'wordpress':4A,17B,26B 'wp':1A,19B,23B,76C,80C,88C 'wp-event-solut':18B,79C 'xss':7A 'xss.this':85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Event Solution plugin at version `4.1.26` or earlier are exposed. The stored script is delivered to visitors and administrators who view the affected event pages, so sites where the plugin is not installed can skip it. Whether an attacker needs a logged-in account depends on the plugin's input paths, which the sources do not state.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112844","severity":null,"published_at":"2026-10-24T08:16:51+00:00","modified_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}