CVE-2026-112844: WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability
Published Oct 24, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.
Affected Software
1 affected component
Arraytics WP Event Solution<=4.1.26
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wp-event-solutionto a version that resolves this vulnerability.Fixed in 4.1.27
Event History
Oct 24, 2026
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need an account or elevated privileges to exploit this issue?
No privileges are required. The vulnerability is reachable over the network, but exploitation requires user interaction.
2
What is the potential impact if exploitation succeeds?
The issue can affect confidentiality, integrity, and availability at low impact levels. Its scope is changed, meaning the impact can extend beyond the vulnerable component's own security authority.