---
id: "CVE-2026-125781"
page: "https://infrastack.ai/live/CVE-2026-125781"
kind: "vulnerability"
aliases: ["CVE-2026-125781"]
title: "NOUS Ouvert Event Post plugin: stored XSS through 6.1.2"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["event-post", "package", "wordpress"]
not_affected_if: ["plugin-newer-than-6.1.2", "plugin-not-installed"]
published_at: "2026-11-11T12:19:50+00:00"
first_seen_at: "2026-11-11T12:27:12+00:00"
updated_at: "2026-11-11T12:28:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125781", "first_seen_at": "2026-11-11T12:27:12+00:00"}]
exploit_sources: []
---

# NOUS Ouvert Event Post plugin: stored XSS through 6.1.2

Link for people: https://infrastack.ai/live/CVE-2026-125781 (this .md is for agents)

The Event post plugin by NOUS Ouvert (event-post) up to version 6.1.2 does not neutralize input before generating web pages, so it stores malicious script. An attacker who can enter event data can run script in the browser of anyone who views the page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Event post plugin (event-post) in the site's plugin list; unknown if the sources give a path.
- Confirm whether the plugin is active on any page that shows events to visitors.

## Fix

- Event post: a fixed version is not stated in the sources; move to a release later than `6.1.2` once the vendor publishes one.

## Timeline

- 2026-11-11T12:27:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125781

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Stored XSS.This issue affects Event post: from n/a through 6.1.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_