{"id":"CVE-2026-114694","kind":"vulnerability","aliases":["CVE-2026-114694"],"related":[],"title":"Events Manager WordPress plugin: reflected XSS through 7.4.8","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.","summary":"Events Manager, a WordPress events plugin by Pixelite, has a reflected cross-site scripting flaw in versions through 7.4.8. An attacker can make a logged-in user's browser run scripts by sending them a crafted link.","severity":"high","cvss":7.1,"epss":0.00251,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["events-manager","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Events Manager plugin version in the WordPress admin under Plugins, or with `wp plugin get events-manager --field=version`\n- Flag any version at or below `7.4.8`","fix":"- Update Events Manager to a version later than `7.4.8` once a patched release is confirmed (unknown from the sources)\n- Until then, deactivate the plugin if it is not needed","status":"open","published_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T03:31:06+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:31:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update Events Manager to a version later than `7.4.8` once a patched release is confirmed (unknown from the sources)\n- Until then, deactivate the plugin if it is not needed","reach":"internet","title":"Events Manager WordPress plugin: reflected XSS through 7.4.8","impact":"medium","summary":"Events Manager, a WordPress events plugin by Pixelite, has a reflected cross-site scripting flaw in versions through 7.4.8. An attacker can make a logged-in user's browser run scripts by sending them a crafted link.","category":"package","nicknames":[],"who_cares":["wordpress","events-manager"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs scripts in a victim's browser on the site","analyst_note":"Confirm the patched version and the vulnerable parameter from the NVD entry or Pixelite's advisory; the sources give only 'through 7.4.8'.","how_to_check":"- Check the installed Events Manager plugin version in the WordPress admin under Plugins, or with `wp plugin get events-manager --field=version`\n- Flag any version at or below `7.4.8`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Events Manager plugin at version 7.4.8 or earlier are exposed. The sources do not say which page or parameter is vulnerable, so the exact trigger path is unknown. Sites that do not run this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000609,"input_tokens":3306,"output_tokens":557,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114694':11A,14A '-2026':10A,13A '7.4.8':8A,39B,89C 'affect':83C 'allow':79C 'attack':41B 'browser':50B 'craft':57B 'cross':32B,68C 'cross-sit':31B,67C 'cve':9A,12A 'event':1A,16B,20B,24B,74C,77C,84C 'events-manag':15B,76C 'flaw':35B 'generat':66C 'improp':59C 'input':62C 'issu':82C 'link':58B 'log':46B 'logged-in':45B 'make':43B 'manag':2A,17B,21B,75C,78C,85C 'n/a':87C 'neutral':60C 'packag':18B 'page':65C 'pixelit':27B,73C 'plugin':4A,25B 'reflect':5A,30B,80C 'run':51B 'script':34B,52B,70C 'send':54B 'site':33B,69C 'user':48B 'version':37B 'vulner':71C 'web':64C 'wordpress':3A,19B,23B 'xss':6A 'xss.this':81C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Events Manager plugin at version 7.4.8 or earlier are exposed. The sources do not say which page or parameter is vulnerable, so the exact trigger path is unknown. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114694","severity":null,"published_at":"2026-10-24T08:16:52+00:00","modified_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114694","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114694","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}