Executive brief
Event Booking Manager for WooCommerce is a WordPress plugin used to create and manage event bookings within WooCommerce stores. A stored cross-site scripting vulnerability allows users with Author role and above to inject malicious JavaScript into event timeline content, which then executes when any visitor (including administrators) views the event page, enabling account takeover or data theft.
Technical details
This is a stored XSS vulnerability (CWE-79) in the event timeline content handling. The plugin fails to sanitise or escape event timeline content (fields mep_day_title[], mep_day_time[], mep_day_content[]) submitted by users with post-editing access before storing and rendering it on the public event page. An attacker with Author role or above can inject arbitrary JavaScript via the Day content field that will be stored in the database and executed in the browsers of all visitors, including administrators. The attack requires authentication as an Author-level user but no additional user interaction; the payload executes automatically on page load. The vulnerability is fixed in version 5.3.7.
Affected products
- Mage Event Booking Manager for WooCommerce before 5.3.7
Timeline
- 2026-07-22: disclosed
- 2026-08-02: patched: Fixed in version 5.3.7