CVE-2026-28162: WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Events Made Easy pluginto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is described as unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations are affected?
Events Made Easy versions 3.2.5 and earlier are identified as affected. The provided data does not state whether a particular plugin configuration or feature must be enabled.
What impact can successful exploitation have?
Successful XSS can affect confidentiality, integrity, and availability at low impact levels. The CVSS vector also indicates scope change, meaning effects may extend beyond the vulnerable component's security authority.