CVE-2026-78333: 12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the payload?
An unauthenticated user can submit the unsanitised value. The stored payload is rendered on an admin-area page, so high-privilege users such as WordPress administrators are the intended targets.
Which plugin versions are affected?
Versions before 3.19.17 are affected. This includes the identified affected range from 3.17 through 3.19.16.
Where is the malicious content stored and triggered?
The submitted value is stored in the plugin's activity log. It executes when that logged value is output on an administrative-area page.