{"id":"CVE-2026-121570","kind":"vulnerability","aliases":["CVE-2026-121570"],"related":[],"title":"WordPress RSVP plugin: stored XSS lets attackers inject scripts into pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17.","summary":"The RSVP and Event Management WordPress plugin by WP Chill fails to sanitize some input, so stored cross-site scripting is possible. An attacker who can submit that input can run scripts in the browsers of people who view the affected page.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","rsvp-and-event-management","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the RSVP and Event Management plugin folder on the server.\n- Compare the installed version against `2.7.17`; the sources list versions through `2.7.17` as affected, with no earlier bound given.","fix":"- RSVP and Event Management (WordPress plugin): versions through `2.7.17` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:38+00:00","updated_at":"2026-11-09T11:26:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:38Z","model":"claude-haiku-5-5","output":{"fix":"- RSVP and Event Management (WordPress plugin): versions through `2.7.17` are affected; the sources do not name a fixed version.","reach":"internet","title":"WordPress RSVP plugin: stored XSS lets attackers inject scripts into pages","impact":"medium","summary":"The RSVP and Event Management WordPress plugin by WP Chill fails to sanitize some input, so stored cross-site scripting is possible. An attacker who can submit that input can run scripts in the browsers of people who view the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","rsvp-and-event-management","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers, stealing sessions","analyst_note":"Confirm the fixed version and which user role can submit the stored input, from the NVD entry or the WP Chill plugin changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or look for the RSVP and Event Management plugin folder on the server.\n- Compare the installed version against `2.7.17`; the sources list versions through `2.7.17` as affected, with no earlier bound given.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the RSVP and Event Management WordPress plugin up to version 2.7.17 are exposed. The description says the flaw is stored, so the risk is highest where visitors or logged-in users can submit content that is later shown to others. Sites without this plugin are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4553,"output_tokens":630,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121570':14A,17A '-2026':13A,16A '2.7.17':104C 'affect':69B,96C 'allow':92C 'attack':7A,52B 'browser':63B 'chill':37B,86C 'cross':46B,80C 'cross-sit':45B,79C 'cve':12A,15A 'event':22B,31B,89C,99C 'fail':38B 'generat':78C 'host':26B 'improp':71C 'inject':8A 'input':42B,57B,74C 'issu':95C 'let':6A 'manag':23B,32B,90C,100C 'n/a':102C 'neutral':72C 'packag':18B 'page':11A,70B,77C 'peopl':65B 'plugin':3A,34B 'possibl':50B 'rsvp':2A,20B,29B,87C,91C,97C 'rsvp-and-event-manag':19B 'run':59B 'sanit':40B 'script':9A,48B,60B,82C 'self':25B 'self-host':24B 'site':47B,81C 'store':4A,44B,93C 'submit':55B 'view':67B 'vulner':83C 'web':76C 'wordpress':1A,27B,33B 'wp':36B,85C 'xss':5A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the RSVP and Event Management WordPress plugin up to version 2.7.17 are exposed. The description says the flaw is stored, so the risk is highest where visitors or logged-in users can submit content that is later shown to others. Sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","rsvpandeventmanagement","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-121570':14A,17A '-2026':13A,16A 'attack':7A 'cve':12A,15A 'inject':8A 'let':6A 'page':11A 'plugin':3A 'rsvp':2A 'script':9A 'store':4A 'wordpress':1A 'xss':5A","search_b":"'affect':69B 'attack':52B 'browser':63B 'chill':37B 'cross':46B 'cross-sit':45B 'event':22B,31B 'fail':38B 'host':26B 'input':42B,57B 'manag':23B,32B 'packag':18B 'page':70B 'peopl':65B 'plugin':34B 'possibl':50B 'rsvp':20B,29B 'rsvp-and-event-manag':19B 'run':59B 'sanit':40B 'script':48B,60B 'self':25B 'self-host':24B 'site':47B 'store':44B 'submit':55B 'view':67B 'wordpress':27B,33B 'wp':36B","search_c":"'2.7.17':104C 'affect':96C 'allow':92C 'chill':86C 'cross':80C 'cross-sit':79C 'event':89C,99C 'generat':78C 'improp':71C 'input':74C 'issu':95C 'manag':90C,100C 'n/a':102C 'neutral':72C 'page':77C 'rsvp':87C,91C,97C 'script':82C 'site':81C 'store':93C 'vulner':83C 'web':76C 'wp':85C 'xss.this':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121570","severity":null,"published_at":"2026-11-09T11:17:22+00:00","modified_at":"2026-11-09T11:17:22+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}