CVE-2026-107649 liedekef CVE debrief

Who should care

WordPress administrators and users with Events Made Easy plugin version 3.2.22 or earlier installed, especially those with guest event submission and forced location creation enabled.

Why it matters

CVE-2026-107649 allows unauthenticated attackers to inject web scripts in pages, requiring verification of administrator configurations and user access controls.

• Unauthenticated attackers can inject arbitrary web scripts
• Scripts execute when a user accesses an injected page
• Verify administrator configurations and user access controls
• Update plugin to version 3.2.23 or later if available

Technical summary

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when both the guest event submission feature and forced location creation are explicitly enabled by a site administrator, as both settings default to off.

Defensive priority

Assess exposure if using Events Made Easy plugin version 3.2.22 or earlier with guest event submission and forced location creation enabled. Verify administrator configurations and user access controls.

Recommended defensive actions

• Assess and verify administrator configurations for guest event submission and forced location creation
• Restrict user access controls to prevent exploitation
• Monitor for suspicious activity and update plugin to version 3.2.23 or later if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts when a user accesses an injected page. Official CVE and NVD records confirm this vulnerability. The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This vulnerability is only exploitable when both the guest event submission feature and forced location creation are explicitly

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.