CVE-2026-121570: WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability

Q: What access does an attacker need to exploit this issue?

The vulnerability is remotely reachable and does not require authentication or privileges. Exploitation does require user interaction.

Q: What is the expected impact if exploitation succeeds?

The issue can result in low-impact compromise of confidentiality, integrity, and availability. The scope is changed, meaning the impact may extend beyond the vulnerable component's own security authority.

Q: Which installations should be considered affected?

RSVP and Event Management versions through 2.7.17 are affected. The provided affected range does not specify a minimum version.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17.

Affected Software

1 affected component

WP Chill RSVP and Event Management<=2.7.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WP Chill RSVP and Event Management to a version that resolves this vulnerability.
Fixed in 2.7.18

Event History

Nov 9, 2026

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is remotely reachable and does not require authentication or privileges. Exploitation does require user interaction.

What is the expected impact if exploitation succeeds?

The issue can result in low-impact compromise of confidentiality, integrity, and availability. The scope is changed, meaning the impact may extend beyond the vulnerable component's own security authority.

Which installations should be considered affected?

RSVP and Event Management versions through 2.7.17 are affected. The provided affected range does not specify a minimum version.

CVE-2026-121570: WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Which installations should be considered affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Which installations should be considered affected?