CVE-2026-17089: Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The shortcode entry point sanitizes 'headerformat' via wpkses(), but the unauthenticated 'searcheventsgrouped' AJAX action bypasses this sanitization entirely, leaving the parameter unsanitized before it is echoed into the HTML body in outputgrouped().
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an attacker to authenticate to WordPress?
No. The vulnerable search_events_grouped AJAX action is accessible to unauthenticated attackers, so no WordPress account or privileges are required.
What user interaction is needed for the injected script to run?
An attacker must persuade a user to perform an action such as clicking a crafted link. The script executes in the context of the affected page when that request is processed.
Why does sanitization in the shortcode path not prevent this issue?
The shortcode entry point applies wp_kses() sanitization to header_format, but the unauthenticated search_events_grouped AJAX action bypasses that processing. The unsanitized value is then echoed into the HTML body by output_grouped().
How can I determine whether my site is in scope?
Check whether the WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin is installed and its version is 7.4.0.1 or earlier. The affected behavior is tied to its unauthenticated search_events_grouped AJAX action handling the header_format parameter.