{"id":"CVE-2026-124259","kind":"vulnerability","aliases":["CVE-2026-124259"],"related":[],"title":"Events Made Easy WordPress plugin: reflected XSS through version 3.3.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franky Events Made Easy events-made-easy allows Reflected XSS.This issue affects Events Made Easy: from n/a through 3.3.5.","summary":"Events Made Easy, a WordPress events plugin by Franky Events, has a reflected cross-site scripting flaw in versions through 3.3.5. An attacker can get a logged-in visitor's browser to run script the attacker wrote by tricking them into opening a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"events-made-easy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["events-made-easy","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Events Made Easy plugin version in the WordPress admin under Plugins.\n- Compare it against the vulnerable range: versions through `3.3.5`.","fix":"- Events Made Easy: unknown; the sources do not state a fixed version.","status":"open","published_at":"2026-11-15T14:17:21+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:36+00:00","updated_at":"2026-11-15T14:37:36+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-15T14:37:36Z","model":"claude-haiku-5-5","output":{"fix":"- Events Made Easy: unknown; the sources do not state a fixed version.","reach":"internet","title":"Events Made Easy WordPress plugin: reflected XSS through version 3.3.5","impact":"medium","summary":"Events Made Easy, a WordPress events plugin by Franky Events, has a reflected cross-site scripting flaw in versions through 3.3.5. An attacker can get a logged-in visitor's browser to run script the attacker wrote by tricking them into opening a crafted link.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","events-made-easy"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs script in visitors' browsers on the site","analyst_note":"Find the fixed version and affected endpoint in the NVD entry or the plugin's changelog; the sources give only the range through 3.3.5.","how_to_check":"- Check the installed Events Made Easy plugin version in the WordPress admin under Plugins.\n- Compare it against the vulnerable range: versions through `3.3.5`.\n- unknown","plain_action":"","product_name":"events-made-easy","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Events Made Easy WordPress plugin at version 3.3.5 or earlier are exposed. The sources do not say which page or input is affected, so the exact configuration needed for exploitation is unknown.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4546,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124259':13A,16A '-2026':12A,15A '3.3.5':10A,48B,107C 'affect':100C 'allow':96C 'attack':50B,64B 'browser':59B 'craft':72B 'cross':41B,83C 'cross-sit':40B,82C 'cve':11A,14A 'easi':3A,24B,29B,91C,95C,103C 'easy':20A 'event':1A,22B,27B,32B,36B,89C,93C,101C 'events':18A 'events-made-easi':21B,92C 'events-made-easy':17A 'flaw':44B 'franki':35B,88C 'generat':81C 'get':52B 'improp':74C 'input':77C 'issu':99C 'link':73B 'log':55B 'logged-in':54B 'made':2A,19A,23B,28B,90C,94C,102C 'n/a':105C 'neutral':75C 'open':70B 'page':80C 'plugin':5A,33B 'reflect':6A,39B,97C 'run':61B 'script':43B,62B,85C 'site':42B,84C 'trick':67B 'version':9A,46B 'visitor':57B 'vulner':86C 'web':79C 'wordpress':4A,26B,31B 'wrote':65B 'xss':7A 'xss.this':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Events Made Easy WordPress plugin at version 3.3.5 or earlier are exposed. The sources do not say which page or input is affected, so the exact configuration needed for exploitation is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["eventsmadeeasy"],"ptokens":["easy","events","made"],"labels":["eventsmadeeasy","high","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-124259':13A,16A '-2026':12A,15A '3.3.5':10A 'cve':11A,14A 'easi':3A 'easy':20A 'event':1A 'events':18A 'events-made-easy':17A 'made':2A,19A 'plugin':5A 'reflect':6A 'version':9A 'wordpress':4A 'xss':7A","search_b":"'3.3.5':48B 'attack':50B,64B 'browser':59B 'craft':72B 'cross':41B 'cross-sit':40B 'easi':24B,29B 'event':22B,27B,32B,36B 'events-made-easi':21B 'flaw':44B 'franki':35B 'get':52B 'link':73B 'log':55B 'logged-in':54B 'made':23B,28B 'open':70B 'plugin':33B 'reflect':39B 'run':61B 'script':43B,62B 'site':42B 'trick':67B 'version':46B 'visitor':57B 'wordpress':26B,31B 'wrote':65B","search_c":"'3.3.5':107C 'affect':100C 'allow':96C 'cross':83C 'cross-sit':82C 'easi':91C,95C,103C 'event':89C,93C,101C 'events-made-easi':92C 'franki':88C 'generat':81C 'improp':74C 'input':77C 'issu':99C 'made':90C,94C,102C 'n/a':105C 'neutral':75C 'page':80C 'reflect':97C 'script':85C 'site':84C 'vulner':86C 'web':79C 'xss.this':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124259","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124259","severity":null,"published_at":"2026-11-15T14:17:21+00:00","modified_at":"2026-11-15T14:17:21+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}