Live › vulnerability › CVE-2026-116394
Go to dashboardWpEvently (mage-eventpress), a WordPress event plugin by Magepeople, does not neutralize script-related HTML tags in a web page, which is a basic cross-site scripting flaw. An attacker can inject script that runs in the browser of other users who view the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
WordPress sites running WpEvently (mage-eventpress) version 5.7.9 or earlier are affected. The sources do not say which input or page is vulnerable, so the exposed surface is unknown. Sites without the plugin installed can skip it.
No product ranges from the sources yet.
5.7.9 and earlier.5.7.9 once the vendor releases one; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-116394")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.