Is CVE-2026-124255 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124255 being exploited in the wild.

How severe is CVE-2026-124255?

Medium severity, with a CVSS score of 5.3, published 11 November 2026.

Which products and versions are affected?

Franky Events Made Easy through 3.3.5.

Is there a fix for CVE-2026-124255?

Yes: fixed in 3.3.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124255 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-124255?

Check whether you run Franky Events Made Easy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124255: Franky Events Made Easy cross-site scripting

CVE-2026-124255 · Severity: medium · CVSS 5.3 · Published 2026-11-11

Events Made Easy is a WordPress plugin that allows users to create and manage events on their websites. The plugin contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into event pages, potentially compromising visitor data or redirecting users to malicious sites. The vulnerability affects versions through 3.3.5 and requires no user authentication to exploit.

Technologies: Franky Events Made Easy. Vendors: Franky.

Quick answers

Is CVE-2026-124255 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124255 being exploited in the wild.
How severe is CVE-2026-124255?: Medium severity, with a CVSS score of 5.3, published 11 November 2026.
Which products and versions are affected?: Franky Events Made Easy through 3.3.5.
Is there a fix for CVE-2026-124255?: Yes: fixed in 3.3.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124255 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-124255?: Check whether you run Franky Events Made Easy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3.6

Technical details

This is a basic XSS vulnerability caused by improper neutralization of HTML script tags in user-supplied input. The vulnerability allows unauthenticated attackers to inject arbitrary HTML and JavaScript code through an unspecified vector, which is then reflected or stored in event pages. An attacker can craft a malicious request to inject code that executes in the context of other users' browsers.

Affected products

Franky Events Made Easy through 3.3.5

Timeline

2026-11-11: disclosed: Published by Patchstack and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.