Executive brief
The EventPress theme for WordPress is vulnerable to a security flaw that allows attackers to execute malicious scripts in the browsers of logged-in users. By tricking an administrator or other user into clicking a specially crafted link, an attacker could potentially steal session cookies or perform unauthorized actions on the website. This issue affects all versions of the theme prior to 22.2.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the EventPress WordPress theme due to insufficient sanitization and escaping of the 'id' parameter within the 'eventpress_customizer_notify_dismiss_action' AJAX handler. An unauthenticated attacker can exploit this by crafting a malicious URL containing a script payload and tricking a logged-in user (such as an administrator) into visiting it. The server reflects the payload back in the response with a 'text/html' content type, leading to script execution in the victim's browser context. This can result in session hijacking or unauthorized administrative actions. The vulnerability is fixed in version 22.2.
Affected products
- EventPress EventPress < 22.2
Timeline
- 2026-05-06: disclosed: Publicly published by WPScan
- 2026-05-27: advisory: NVD published the CVE record
- 2026-05-27: patched: Fixed in version 22.2