{"id":"CVE-2026-124255","kind":"vulnerability","aliases":["CVE-2026-124255"],"related":[],"title":"Events Made Easy WordPress plugin: stored XSS through 3.3.5","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events-made-easy allows Code Injection.This issue affects Events Made Easy: from n/a through 3.3.5.","summary":"Events Made Easy, a WordPress events plugin by Franky, has a cross-site scripting flaw in versions through 3.3.5. An attacker can inject script tags into a page that other visitors then run in their browsers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"events-made-easy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["events-made-easy","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Events Made Easy plugin version in the WordPress admin under Plugins.\n- Confirm whether the `events-made-easy` plugin folder exists in `wp-content/plugins/`.","fix":"- Events Made Easy: a fixed version above `3.3.5` (the sources do not name it).","status":"open","published_at":"2026-11-11T12:19:46+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:57+00:00","updated_at":"2026-11-11T12:28:57+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T12:28:57Z","model":"claude-haiku-5-5","output":{"fix":"- Events Made Easy: a fixed version above `3.3.5` (the sources do not name it).","reach":"internet","title":"Events Made Easy WordPress plugin: stored XSS through 3.3.5","impact":"medium","summary":"Events Made Easy, a WordPress events plugin by Franky, has a cross-site scripting flaw in versions through 3.3.5. An attacker can inject script tags into a page that other visitors then run in their browsers.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","events-made-easy"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Confirm the first fixed version and whether authentication is needed, using the NVD entry and the plugin's WordPress.org changelog.","how_to_check":"- Check the installed Events Made Easy plugin version in the WordPress admin under Plugins.\n- Confirm whether the `events-made-easy` plugin folder exists in `wp-content/plugins/`.","plain_action":"","product_name":"events-made-easy","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Events Made Easy WordPress plugin at version 3.3.5 or earlier. The flaw is in how the plugin handles HTML in web pages, so exposure depends on the plugin being installed and active. Sites without the plugin can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4553,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124255':12A,15A '-2026':11A,14A '3.3.5':9A,45B,98C 'affect':91C 'allow':87C 'attack':47B 'basic':75C 'browser':62B 'code':88C 'cross':38B 'cross-sit':37B 'cve':10A,13A 'easi':3A,23B,28B,82C,86C,94C 'easy':19A 'event':1A,21B,26B,31B,80C,84C,92C 'events':17A 'events-made-easi':20B,83C 'events-made-easy':16A 'flaw':41B 'franki':34B,79C 'html':69C 'improp':63C 'inject':49B 'injection.this':89C 'issu':90C 'made':2A,18A,22B,27B,81C,85C,93C 'n/a':96C 'neutral':64C 'page':54B,74C 'plugin':5A,32B 'relat':68C 'run':59B 'script':40B,50B,67C 'script-rel':66C 'site':39B 'store':6A 'tag':51B,70C 'version':43B 'visitor':57B 'vulner':77C 'web':73C 'wordpress':4A,25B,30B 'xss':7A,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Events Made Easy WordPress plugin at version 3.3.5 or earlier. The flaw is in how the plugin handles HTML in web pages, so exposure depends on the plugin being installed and active. Sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["eventsmadeeasy"],"ptokens":["easy","events","made"],"labels":["eventsmadeeasy","medium","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-124255':12A,15A '-2026':11A,14A '3.3.5':9A 'cve':10A,13A 'easi':3A 'easy':19A 'event':1A 'events':17A 'events-made-easy':16A 'made':2A,18A 'plugin':5A 'store':6A 'wordpress':4A 'xss':7A","search_b":"'3.3.5':45B 'attack':47B 'browser':62B 'cross':38B 'cross-sit':37B 'easi':23B,28B 'event':21B,26B,31B 'events-made-easi':20B 'flaw':41B 'franki':34B 'inject':49B 'made':22B,27B 'page':54B 'plugin':32B 'run':59B 'script':40B,50B 'site':39B 'tag':51B 'version':43B 'visitor':57B 'wordpress':25B,30B","search_c":"'3.3.5':98C 'affect':91C 'allow':87C 'basic':75C 'code':88C 'easi':82C,86C,94C 'event':80C,84C,92C 'events-made-easi':83C 'franki':79C 'html':69C 'improp':63C 'injection.this':89C 'issu':90C 'made':81C,85C,93C 'n/a':96C 'neutral':64C 'page':74C 'relat':68C 'script':67C 'script-rel':66C 'tag':70C 'vulner':77C 'web':73C 'xss':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124255","severity":null,"published_at":"2026-11-11T12:19:46+00:00","modified_at":"2026-11-11T12:19:46+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}