CVE-2026-66457: WordPress Events Manager plugin <= 7.4.1 - Cross Site Scripting (XSS) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 versions.

Affected Software

1 affected component

WordPress Events Manager plugin<=7.4.1

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Events Manager plugin to a version that resolves this vulnerability.
Fixed in 7.4.1Patch <= 7.4.1

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

CVE-2026-66457 has a high severity rating of 7.1.

CVE-2026-66457 is a Cross Site Scripting (XSS) vulnerability.

To fix CVE-2026-66457, update the WordPress Events Manager plugin to version 7.4.2 or later.

Any WordPress site using Events Manager plugin versions 7.4.1 or earlier is affected by CVE-2026-66457.

Attackers can exploit CVE-2026-66457 to inject malicious scripts into web pages viewed by users.