CVE-2026-66457: WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/events-managerto a version that resolves this vulnerability.Fixed in 7.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66457?
CVE-2026-66457 has a high severity rating of 7.1.
What type of vulnerability is identified in CVE-2026-66457?
CVE-2026-66457 is a Cross Site Scripting (XSS) vulnerability.
How do I fix CVE-2026-66457?
To fix CVE-2026-66457, update the WordPress Events Manager plugin to version 7.4.2 or later.
Who is affected by CVE-2026-66457?
Any WordPress site using Events Manager plugin versions 7.4.1 or earlier is affected by CVE-2026-66457.
What actions can attackers perform using CVE-2026-66457?
Attackers can exploit CVE-2026-66457 to inject malicious scripts into web pages viewed by users.