CVE-2026-16063: Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16063?
The severity of CVE-2026-16063 is rated at 45, indicating a significant risk level due to stored cross-site scripting vulnerabilities.
How do I fix CVE-2026-16063?
To fix CVE-2026-16063, update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later.
What type of vulnerability is CVE-2026-16063?
CVE-2026-16063 is classified as a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-16063?
Users with the Author role and above are affected by CVE-2026-16063, as they can inject malicious JavaScript.
What is the impact of CVE-2026-16063 on a website?
The impact of CVE-2026-16063 can allow attackers to execute arbitrary JavaScript in the context of users viewing public event pages.