CVE-2026-107649: Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[locationname]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when both the guest event submission feature (emefs[guestsubmit]) and forced location creation (emefs[forcelocationcreation]) are explicitly enabled by a site administrator, as both settings default to off.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Keep guest event submission and forced location creation disabled; the vulnerability is exploitable only when both settings are explicitly enabled.
Events Made Easy WordPress plugin eme_fs[guest_submit] and eme_fs[force_location_creation] = off
Event History
Frequently Asked Questions
Are sites using the plugin’s default settings exposed?
No. Exploitation requires both guest event submission (eme_fs[guest_submit]) and forced location creation (eme_fs[force_location_creation]) to be explicitly enabled by an administrator; both settings are off by default.
What does an attacker need to exploit this issue?
An attacker does not need authentication, but must be able to submit a guest event while forced location creation is enabled. They can inject script through the event[location_name] parameter.
Who is affected if malicious content has been submitted?
The injected script executes in the browser of any user who accesses the page containing the malicious event or location content. The issue can affect confidentiality and integrity in that user’s browser context.
What can be done if updating is not immediately possible?
Disable either guest event submission or forced location creation, since both features must be enabled for exploitation. Review submitted event location names for injected script content.