Is CVE-2026-28162 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28162 being exploited in the wild.

How severe is CVE-2026-28162?

High severity, with a CVSS score of 7.1, published 24 August 2026.

Which products and versions are affected?

Events Made Easy Events Made Easy <=3.2.5.

Is there a fix for CVE-2026-28162?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-28162 attacked?

It is attacked over the network.

Am I affected by CVE-2026-28162?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28162: Events Made Easy cross-site scripting (XSS)

Q: Is there a fix for CVE-2026-28162?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-28162 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-28162?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28162 · Severity: high · CVSS 7.1 · Published 2026-08-24

Events Made Easy is a WordPress plugin for creating and managing events and ticketing. This vulnerability allows an attacker to inject malicious scripts into the plugin without authentication, potentially stealing visitor data, hijacking user accounts, or defacing the website. Organizations using this plugin should upgrade immediately to patch the flaw.

Quick answers

Is CVE-2026-28162 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28162 being exploited in the wild.
How severe is CVE-2026-28162?: High severity, with a CVSS score of 7.1, published 24 August 2026.
Which products and versions are affected?: Events Made Easy Events Made Easy <=3.2.5.
Is there a fix for CVE-2026-28162?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28162 attacked?: It is attacked over the network.
Am I affected by CVE-2026-28162?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an unauthenticated stored or reflected cross-site scripting (XSS) vulnerability in Events Made Easy versions 3.2.5 and earlier. The plugin fails to properly sanitize or escape user-supplied input before rendering it in the web interface. An attacker can craft a malicious payload (typically via URL parameter or form field) that executes JavaScript in the context of the affected page, allowing script injection without requiring authentication. The vulnerability is exploitable via network vector and has user-interaction requirements. Patch version 3.2.6 resolves the issue; organizations should update immediately.

Affected products

Events Made Easy Events Made Easy <=3.2.5

Timeline

2026-08-24: disclosed
2026-08-20: advisory: Patchstack advisory published
2026-07-05: other: Reported by sequence_X0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.