CVE-2026-125781: WordPress Event post plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need?

An attacker needs low-level privileges to exploit the issue. The attack can be carried out over the network with low attack complexity.

Q: Does exploitation require someone else to interact with malicious content?

Yes. The vector indicates that user interaction is required, meaning another user must interact with attacker-supplied content for the XSS payload to take effect.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Stored XSS.This issue affects Event post: from n/a through 6.1.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Event post plugin to a version that resolves this vulnerability.
Fixed in 6.1.3

Event History

Nov 11, 2026

CVE Published

via MITRE·11:35 AM

Data Sourced

via MITRE·11:35 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

An attacker needs low-level privileges to exploit the issue. The attack can be carried out over the network with low attack complexity.

Does exploitation require someone else to interact with malicious content?

Yes. The vector indicates that user interaction is required, meaning another user must interact with attacker-supplied content for the XSS payload to take effect.

CVE-2026-125781: WordPress Event post plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need?

Does exploitation require someone else to interact with malicious content?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Does exploitation require someone else to interact with malicious content?