EVENTS-MADE-EASY · CVE-2026-124259 · Other
NO FIX YET · SEE WHAT TO DO
Events Made Easy, a WordPress events plugin by Franky Events, has a reflected cross-site scripting flaw in versions through 3.3.5. An attacker can get a logged-in visitor's browser to run script the attacker wrote by tricking them into opening a crafted link.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Events Made Easy WordPress plugin at version 3.3.5 or earlier are exposed. The sources do not say which page or input is affected, so the exact configuration needed for exploitation is unknown.
Not affected if plugin-not-installed
Who cares events-made-easy, wordpress
3.3.5.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franky Events Made Easy events-made-easy allows Reflected XSS.This issue affects Events Made Easy: from n/a through 3.3.5.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.