{"id":"CVE-2026-125781","kind":"vulnerability","aliases":["CVE-2026-125781"],"related":[],"title":"NOUS Ouvert Event Post plugin: stored XSS through 6.1.2","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Stored XSS.This issue affects Event post: from n/a through 6.1.2.","summary":"The Event post plugin by NOUS Ouvert (event-post) up to version 6.1.2 does not neutralize input before generating web pages, so it stores malicious script. An attacker who can enter event data can run script in the browser of anyone who views the page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-post","package","wordpress"],"not_affected_if":["plugin-newer-than-6.1.2","plugin-not-installed"],"how_to_check":"- Check the installed version of the Event post plugin (event-post) in the site's plugin list; unknown if the sources give a path.\n- Confirm whether the plugin is active on any page that shows events to visitors.","fix":"- Event post: a fixed version is not stated in the sources; move to a release later than `6.1.2` once the vendor publishes one.","status":"open","published_at":"2026-11-11T12:19:50+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","triaged_at":"2026-11-11T12:28:27+00:00","updated_at":"2026-11-11T12:28:27+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T12:28:27Z","model":"claude-haiku-5-5","output":{"fix":"- Event post: a fixed version is not stated in the sources; move to a release later than `6.1.2` once the vendor publishes one.","reach":"internet","title":"NOUS Ouvert Event Post plugin: stored XSS through 6.1.2","impact":"medium","summary":"The Event post plugin by NOUS Ouvert (event-post) up to version 6.1.2 does not neutralize input before generating web pages, so it stores malicious script. An attacker who can enter event data can run script in the browser of anyone who views the page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","event-post"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers and steals sessions","analyst_note":"Check the NVD entry and the vendor page for the fixed version and the required privilege level for storing event content.","how_to_check":"- Check the installed version of the Event post plugin (event-post) in the site's plugin list; unknown if the sources give a path.\n- Confirm whether the plugin is active on any page that shows events to visitors.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-newer-than-6.1.2"],"who_is_affected":"Sites running the Event post (event-post) plugin from NOUS Ouvert at version 6.1.2 or earlier are exposed when event content is stored and shown to visitors. Sites without this plugin can skip it. The sources do not describe the exact input path or the required user role.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000754,"input_tokens":4552,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125781':12A,15A '-2026':11A,14A '6.1.2':9A,34B,101C 'affect':95C 'allow':91C 'anyon':62B 'attack':49B 'browser':60B 'cross':76C 'cross-sit':75C 'cve':10A,13A 'data':54B 'enter':52B 'et':84C 'event':3A,17B,22B,29B,53B,86C,89C,96C 'event-post':16B,28B,88C 'generat':40B,74C 'improp':67C 'input':38B,70C 'issu':94C 'malici':46B 'n/a':99C 'neutral':37B,68C 'nous':1A,26B,81C 'ouvert':2A,27B,82C 'packag':19B 'page':42B,66B,73C 'plugin':5A,24B 'post':4A,18B,23B,30B,87C,90C,97C 'run':56B 'script':47B,57B,78C 'simpl':85C 'site':77C 'store':6A,45B,92C 'util':83C 'version':33B 'view':64B 'vulner':79C 'web':41B,72C 'wordpress':20B 'xss':7A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Event post (event-post) plugin from NOUS Ouvert at version 6.1.2 or earlier are exposed when event content is stored and shown to visitors. Sites without this plugin can skip it. The sources do not describe the exact input path or the required user role.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventpost","medium","package","wordpress"],"campaign_type":null,"search_a":"'-125781':12A,15A '-2026':11A,14A '6.1.2':9A 'cve':10A,13A 'event':3A 'nous':1A 'ouvert':2A 'plugin':5A 'post':4A 'store':6A 'xss':7A","search_b":"'6.1.2':34B 'anyon':62B 'attack':49B 'browser':60B 'data':54B 'enter':52B 'event':17B,22B,29B,53B 'event-post':16B,28B 'generat':40B 'input':38B 'malici':46B 'neutral':37B 'nous':26B 'ouvert':27B 'packag':19B 'page':42B,66B 'plugin':24B 'post':18B,23B,30B 'run':56B 'script':47B,57B 'store':45B 'version':33B 'view':64B 'web':41B 'wordpress':20B","search_c":"'6.1.2':101C 'affect':95C 'allow':91C 'cross':76C 'cross-sit':75C 'et':84C 'event':86C,89C,96C 'event-post':88C 'generat':74C 'improp':67C 'input':70C 'issu':94C 'n/a':99C 'neutral':68C 'nous':81C 'ouvert':82C 'page':73C 'post':87C,90C,97C 'script':78C 'simpl':85C 'site':77C 'store':92C 'util':83C 'vulner':79C 'web':72C 'xss.this':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125781","severity":null,"published_at":"2026-11-11T12:19:50+00:00","modified_at":"2026-11-11T12:19:50+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","fetched_at":"2026-11-11T12:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}