{"id":"CVE-2026-123480","kind":"vulnerability","aliases":["CVE-2026-123480"],"related":[],"title":"WordPress Eventbrite Events plugin: stored XSS through 6.9.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api allows Stored XSS.This issue affects Display Eventbrite Events: from n/a through 6.9.1.","summary":"The Display Eventbrite Events WordPress plugin by Fullworks does not neutralize input when generating pages, enabling stored cross-site scripting. An attacker who can store input in the plugin can run scripts in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"widget-for-eventbrite-api","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["display-eventbrite-events","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Display Eventbrite Events plugin (slug widget-for-eventbrite-api) is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version against `6.9.1`; versions up to and including `6.9.1` are listed as affected.","fix":"- Display Eventbrite Events (widget-for-eventbrite-api): unknown; the sources do not name a fixed version.","status":"open","published_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:29:21+00:00","updated_at":"2026-11-11T13:29:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T13:29:21Z","model":"claude-haiku-5-5","output":{"fix":"- Display Eventbrite Events (widget-for-eventbrite-api): unknown; the sources do not name a fixed version.","reach":"internet","title":"WordPress Eventbrite Events plugin: stored XSS through 6.9.1","impact":"medium","summary":"The Display Eventbrite Events WordPress plugin by Fullworks does not neutralize input when generating pages, enabling stored cross-site scripting. An attacker who can store input in the plugin can run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","display-eventbrite-events","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and whether authentication is required, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-123480 and the plugin's WordPress.org changelog.","how_to_check":"- Check whether the Display Eventbrite Events plugin (slug widget-for-eventbrite-api) is installed and its version in the WordPress admin under Plugins.\n- Compare the installed version against `6.9.1`; versions up to and including `6.9.1` are listed as affected.","plain_action":"","product_name":"widget-for-eventbrite-api","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Display Eventbrite Events WordPress plugin up to version 6.9.1 are in scope. Sites without the plugin installed are not affected. The sources do not say whether the stored input must come from logged-in users.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000782,"input_tokens":4564,"output_tokens":651,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123480':11A,14A '-2026':10A,13A '6.9.1':8A,101C 'affect':94C 'allow':90C 'api':19A,89C 'attack':51B 'browser':65B 'cross':47B,75C 'cross-sit':46B,74C 'cve':9A,12A 'display':21B,30B,82C,95C 'display-eventbrite-ev':20B 'enabl':44B 'event':3A,23B,32B,84C,97C 'eventbrit':2A,22B,31B,83C,88C,96C 'eventbrite':18A 'for':17A 'fullwork':36B,80C 'generat':42B,73C 'host':27B 'improp':66C 'input':40B,55B,69C 'issu':93C 'n/a':99C 'neutral':39B,67C 'packag':24B 'page':43B,72C 'plugin':4A,34B,58B,81C 'run':60B 'script':49B,61B,77C 'self':26B 'self-host':25B 'site':48B,76C 'store':5A,45B,54B,91C 'visitor':64B 'vulner':78C 'web':71C 'widget':16A,86C 'widget-for-eventbrite-api':15A,85C 'wordpress':1A,28B,33B 'xss':6A 'xss.this':92C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Display Eventbrite Events WordPress plugin up to version 6.9.1 are in scope. Sites without the plugin installed are not affected. The sources do not say whether the stored input must come from logged-in users.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["widgetforeventbriteapi"],"ptokens":["api","eventbrite","for","widget"],"labels":["displayeventbriteevents","medium","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-123480':11A,14A '-2026':10A,13A '6.9.1':8A 'api':19A 'cve':9A,12A 'event':3A 'eventbrit':2A 'eventbrite':18A 'for':17A 'plugin':4A 'store':5A 'widget':16A 'widget-for-eventbrite-api':15A 'wordpress':1A 'xss':6A","search_b":"'attack':51B 'browser':65B 'cross':47B 'cross-sit':46B 'display':21B,30B 'display-eventbrite-ev':20B 'enabl':44B 'event':23B,32B 'eventbrit':22B,31B 'fullwork':36B 'generat':42B 'host':27B 'input':40B,55B 'neutral':39B 'packag':24B 'page':43B 'plugin':34B,58B 'run':60B 'script':49B,61B 'self':26B 'self-host':25B 'site':48B 'store':45B,54B 'visitor':64B 'wordpress':28B,33B","search_c":"'6.9.1':101C 'affect':94C 'allow':90C 'api':89C 'cross':75C 'cross-sit':74C 'display':82C,95C 'event':84C,97C 'eventbrit':83C,88C,96C 'fullwork':80C 'generat':73C 'improp':66C 'input':69C 'issu':93C 'n/a':99C 'neutral':67C 'page':72C 'plugin':81C 'script':77C 'site':76C 'store':91C 'vulner':78C 'web':71C 'widget':86C 'widget-for-eventbrite-api':85C 'xss.this':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123480","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123480","severity":null,"published_at":"2026-11-11T13:17:17+00:00","modified_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}