Executive brief
The Events Manager is a popular WordPress plugin that manages event calendars, bookings, and ticketing. An unauthenticated attacker can inject malicious JavaScript code into event pages by crafting a malicious link. If a user clicks the link, their browser will execute the attacker's script, potentially leading to account hijacking, data theft, or malware distribution.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the 'header_format' parameter of The Events Manager plugin. The vulnerable code path is the unauthenticated 'search_events_grouped' AJAX action, which bypasses the wp_kses() sanitization that is applied in the shortcode entry point. The unsanitized 'header_format' parameter is echoed directly into the HTML body within the output_grouped() function without proper output escaping. An attacker can craft a malicious URL containing JavaScript in the 'header_format' parameter; when an unauthenticated user clicks the link, the script executes in their browser. No authentication or special privileges are required. A patch should be available in version 7.4.0.2 or later.
Affected products
- WordPress Events Manager up to and including 7.4.0.1
Timeline
- 2026-08-25: disclosed