CVE-2026-123480: WordPress Display Eventbrite Events plugin <= 6.9.1 - Cross Site Scripting (XSS) vulnerability

Q: What level of access and interaction are required to exploit this issue?

The listed vector requires network access, low attack complexity, low privileges, and user interaction. This indicates an attacker must have a low-privileged account or equivalent ability to submit content, and a user must later interact with the injected content.

Q: What impact could successful exploitation have?

Successful stored XSS can affect confidentiality, integrity, and availability at a low level. The scope is changed, meaning the impact may extend beyond the vulnerable plugin's own security authority.

Q: Which plugin versions are affected?

Display Eventbrite Events versions through 6.9.1 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fullworks Plugins Display Eventbrite Events widget-for-eventbrite-api allows Stored XSS.This issue affects Display Eventbrite Events: from n/a through 6.9.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fullworks Plugins Display Eventbrite Events to a version that resolves this vulnerability.
Fixed in 6.9.2

Event History

Nov 11, 2026

CVE Published

via MITRE·12:41 PM

Data Sourced

via MITRE·12:41 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access and interaction are required to exploit this issue?

The listed vector requires network access, low attack complexity, low privileges, and user interaction. This indicates an attacker must have a low-privileged account or equivalent ability to submit content, and a user must later interact with the injected content.

What impact could successful exploitation have?

Successful stored XSS can affect confidentiality, integrity, and availability at a low level. The scope is changed, meaning the impact may extend beyond the vulnerable plugin's own security authority.

Which plugin versions are affected?

Display Eventbrite Events versions through 6.9.1 are affected. The available data does not identify a fixed version.

CVE-2026-123480: WordPress Display Eventbrite Events plugin <= 6.9.1 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What level of access and interaction are required to exploit this issue?

What impact could successful exploitation have?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access and interaction are required to exploit this issue?

What impact could successful exploitation have?

Which plugin versions are affected?