CVE-2026-116394: WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation is network-accessible and requires neither prior privileges nor user interaction. The attack complexity is rated low.

Q: What is the expected impact if exploitation succeeds?

The reported impact is limited to confidentiality, with no integrity or availability impact indicated. The issue is rated medium severity with a CVSS score of 5.3.

Published Oct 26, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection.This issue affects WpEvently: from n/a through 5.7.9.

Affected Software

1 affected component

MagePeople WpEvently<=5.7.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WpEvently plugin to a version that resolves this vulnerability.
Fixed in 5.7.10

Event History

Oct 26, 2026

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation is network-accessible and requires neither prior privileges nor user interaction. The attack complexity is rated low.

What is the expected impact if exploitation succeeds?