CVE-2026-124255: WordPress Events Made Easy plugin <= 3.3.5 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events-made-easy allows Code Injection.This issue affects Events Made Easy: from n/a through 3.3.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/events-made-easyto a version that resolves this vulnerability.Fixed in 3.3.6
Event History
Frequently Asked Questions
Which deployments are affected?
Events Made Easy versions through 3.3.5 are affected. The provided information does not identify a safe fixed version.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact of successful exploitation?
The issue is described as basic XSS/content injection and is rated for low confidentiality impact, with no integrity or availability impact in the supplied CVSS vector.