{"id":"CVE-2026-116394","kind":"vulnerability","aliases":["CVE-2026-116394"],"related":[],"title":"WpEvently WordPress plugin: stored XSS via unescaped script tags","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9.","summary":"WpEvently (mage-eventpress), a WordPress event plugin by Magepeople, does not neutralize script-related HTML tags in a web page, which is a basic cross-site scripting flaw. An attacker can inject script that runs in the browser of other users who view the affected page.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mage-eventpress","package","wordpress","wpevently"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WpEvently (mage-eventpress) plugin version in the WordPress admin under Plugins; affected versions are `5.7.9` and earlier.\n- unknown for other checks; the sources do not say which pages or inputs are exposed.","fix":"- Update WpEvently (mage-eventpress) to a version later than `5.7.9` once the vendor releases one; the sources do not name the fixed version.\n- unknown for interim mitigations.","status":"open","published_at":"2026-10-26T16:17:18+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:33:01+00:00","updated_at":"2026-10-26T16:33:01+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T16:33:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update WpEvently (mage-eventpress) to a version later than `5.7.9` once the vendor releases one; the sources do not name the fixed version.\n- unknown for interim mitigations.","reach":"internet","title":"WpEvently WordPress plugin: stored XSS via unescaped script tags","impact":"medium","summary":"WpEvently (mage-eventpress), a WordPress event plugin by Magepeople, does not neutralize script-related HTML tags in a web page, which is a basic cross-site scripting flaw. An attacker can inject script that runs in the browser of other users who view the affected page.","category":"package","nicknames":[],"who_cares":["wordpress","wpevently","mage-eventpress"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the affected site.","analyst_note":"Find the fixed version and the vulnerable input or page in the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116394.","how_to_check":"- Check the installed WpEvently (mage-eventpress) plugin version in the WordPress admin under Plugins; affected versions are `5.7.9` and earlier.\n- unknown for other checks; the sources do not say which pages or inputs are exposed.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running WpEvently (mage-eventpress) version 5.7.9 or earlier are affected. The sources do not say which input or page is vulnerable, so the exposed surface is unknown. Sites without the plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00064,"input_tokens":3318,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116394':12A,15A '-2026':11A,14A '5.7.9':102C 'affect':69B,97C 'allow':93C 'attack':54B 'basic':47B,83C 'browser':62B 'code':94C 'cross':49B 'cross-sit':48B 'cve':10A,13A 'event':28B 'eventpress':18B,25B,92C 'flaw':52B 'html':38B,77C 'improp':71C 'inc':88C 'inject':56B 'injection.this':95C 'issu':96C 'mage':17B,24B,91C 'mage-eventpress':16B,23B,90C 'magepeopl':31B,87C 'n/a':100C 'neutral':34B,72C 'packag':19B 'page':43B,70B,82C 'plugin':3A,29B 'relat':37B,76C 'run':59B 'script':8A,36B,51B,57B,75C 'script-rel':35B,74C 'site':50B 'store':4A 'tag':9A,39B,78C 'unescap':7A 'user':65B 'via':6A 'view':67B 'vulner':85C 'web':42B,81C 'wordpress':2A,20B,27B 'wpevent':1A,21B,22B,89C,98C 'xss':5A,84C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running WpEvently (mage-eventpress) version 5.7.9 or earlier are affected. The sources do not say which input or page is vulnerable, so the exposed surface is unknown. Sites without the plugin installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116394","severity":null,"published_at":"2026-10-26T16:17:18+00:00","modified_at":"2026-10-26T16:17:18+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}