CVE-2026-114694: WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates the attack can be performed remotely with low complexity and requires no attacker privileges. It does require user interaction.

Q: Which installations are in scope?

Pixelite Events Manager versions through 7.4.8 are affected. The available data does not identify a fixed version.

Q: What is the expected impact if exploitation succeeds?

The supplied CVSS metrics indicate low impacts to confidentiality, integrity, and availability, with a changed scope.

Published Oct 24, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.

Affected Software

1 affected component

Pixelite Events Manager<=7.4.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Events Manager plugin to a version that resolves this vulnerability.
Fixed in 7.4.9

Event History

Oct 24, 2026

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates the attack can be performed remotely with low complexity and requires no attacker privileges. It does require user interaction.

Which installations are in scope?