Quick answers
- Is CVE-2026-16063 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16063 being exploited in the wild.
- How severe is CVE-2026-16063?
- Medium severity, with a CVSS score of 5.4, published 2 August 2026.
- Which products and versions are affected?
- Mage Event Booking Manager for WooCommerce before 5.3.7.
- Is there a fix for CVE-2026-16063?
- A patch was published on 2026-08-02: Fixed in version 5.3.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-16063 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-16063?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored XSS vulnerability (CWE-79) in the event timeline content handling. The plugin fails to sanitise or escape event timeline content (fields mep_day_title[], mep_day_time[], mep_day_content[]) submitted by users with post-editing access before storing and rendering it on the public event page. An attacker with Author role or above can inject arbitrary JavaScript via the Day content field that will be stored in the database and executed in the browsers of all visitors, including administrators. The attack requires authentication as an Author-level user but no additional user interaction; the payload executes automatically on page load. The vulnerability is fixed in version 5.3.7.
Affected products
- Mage Event Booking Manager for WooCommerce before 5.3.7
Timeline
- 2026-07-22: disclosed
- 2026-08-02: patched: Fixed in version 5.3.7