PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8898 ruchit47 CVE debrief

The Events In City plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'org-events' shortcode in versions up to and including 3.0. The vulnerability exists in the org_event_scode() function, where user-supplied attributes—including 'organizer_id', 'width', 'height', 'transparency', 'header', 'border', and 'layout'—are concatenated directly into HTML attributes without proper sanitization or output escaping via esc_attr(). This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when users access the injected content. The vulnerability was published on May 27, 2026, and is classified as MEDIUM severity with a CVSS score of 6.4.

Vendor
ruchit47
Product
Events In City
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

WordPress site administrators using the Events In City plugin; security teams monitoring plugin vulnerabilities; developers maintaining WordPress shortcode implementations

Technical summary

The org_event_scode() function in the Events In City WordPress plugin (≤3.0) fails to sanitize or escape user-supplied shortcode attributes before concatenating them into HTML output. Multiple attributes (organizer_id, width, height, transparency, header, border, layout) are affected. The missing esc_attr() calls allow JavaScript injection through attribute value manipulation. Attackers with contributor or higher privileges can embed malicious shortcodes in posts/pages, achieving persistent script execution in victim browsers.

Defensive priority

medium

Recommended defensive actions

  • Update the Events In City WordPress plugin to a version newer than 3.0 if available
  • If no patch is available, disable the plugin or restrict contributor-level access until remediation
  • Review existing posts and pages for suspicious org-events shortcode usage
  • Implement Content Security Policy (CSP) headers to mitigate XSS impact
  • Enable WordPress auto-updates for plugins where feasible
  • Conduct security review of custom shortcode implementations for similar patterns

Evidence notes

The vulnerability is confirmed through source code analysis showing direct attribute concatenation at lines 144 and 156 of ae_org_widget.php in version 3.0 of the plugin. The CWE-79 classification and CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) are provided by Wordfence.

Official resources

The vulnerability was disclosed on May 27, 2026, via the NVD and Wordfence.