CVE-2026-27394: WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

No authentication is required. Exploitation does require a victim to interact with attacker-controlled content, as indicated by the UI:R vector.

Q: What security impact can successful exploitation have?

Successful XSS can affect confidentiality, integrity, and availability, each rated Low in the supplied CVSS vector. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable component's security authority.

Q: Which plugin versions are affected?

Eventer versions 0.1.1 and earlier are identified as affected. The provided data does not state a fixed version.

Published Oct 29, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:23 PM

Data Sourced

via MITRE·03:23 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

No authentication is required. Exploitation does require a victim to interact with attacker-controlled content, as indicated by the UI:R vector.

What security impact can successful exploitation have?

Successful XSS can affect confidentiality, integrity, and availability, each rated Low in the supplied CVSS vector. The scope is changed (S:C), meaning the impact can extend beyond the vulnerable component's security authority.

Which plugin versions are affected?

Eventer versions 0.1.1 and earlier are identified as affected. The provided data does not state a fixed version.

CVE-2026-27394: WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What security impact can successful exploitation have?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What security impact can successful exploitation have?

Which plugin versions are affected?