CVE-2026-2387: Event Organiser WordPress Plugin Stored XSS Vulnerability (v3.12.9)

Technical summary

The vulnerability stems from insufficient output escaping in the Event Organiser plugin's handling of the 'eo_events' shortcode. Specifically, the 'no_events' parameter—which controls the message displayed when no events match filter criteria—is rendered directly into event list templates without proper sanitization or escaping. This allows authenticated attackers to bypass initial input validation and inject arbitrary JavaScript payloads that are stored persistently and executed in victim browsers. The issue affects all versions through 3.12.9 and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

Organizations running Event Organiser 3.12.9 or earlier face session hijacking, credential theft, and defacement risks if Contributors or higher-privileged users are compromised or are malicious insiders. The vulnerability is particularly concerning for multi-author WordPress installations where Contributors have page creation rights. Successful exploitation could damage site reputation, trigger visitor data loss, and create compliance violations if personal information is harvested through injected scripts.

Affected systems

The Event Organiser WordPress plugin in all versions up to and including 3.12.9 is affected. This includes sites that have not updated to the latest stable release. WordPress multisite and single-site installations with the plugin active are vulnerable if any user account with Contributor-level access or above exists.

Exploitability

Exploitation requires valid WordPress authentication at Contributor level or above. While this restricts the attack surface compared to unauthenticated XSS, many WordPress sites maintain multiple author accounts, user accounts are frequently compromised, and insider threat scenarios are plausible. The lack of interaction requirements (CVSS UI:N) means the injected payload executes automatically when a user views a page containing the affected shortcode, making the attack reliable and scalable across site visitors.

Remediation

Update the Event Organiser plugin to a patched version beyond 3.12.9 as soon as available. If an immediate patch is unavailable, consider disabling the plugin or restricting Contributor-level access to only trusted internal staff. Review the 'eo_events' shortcode usage across your site and audit any pages using the 'no_events' parameter for suspicious content. Inspect site logs and database backups for evidence of injected payloads.

Patch guidance

Check the official Event Organiser plugin repository and changelog for available updates beyond version 3.12.9. Apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > Update) after testing in a staging environment to ensure compatibility with your theme and other plugins. Verify the fix by confirming the plugin version post-update and testing the 'eo_events' shortcode to ensure functionality is restored.

Detection guidance

Search your WordPress database and page/post content for instances of the 'eo_events' shortcode with 'no_events' parameters containing suspicious HTML, JavaScript, or encoded payloads. Review WordPress user logs to identify Contributor-level or higher accounts that modified pages during the vulnerability window. Monitor for suspicious JavaScript execution on event list pages using browser developer tools or Web Application Firewall (WAF) rules. Check site backups for comparison to identify when malicious payloads were introduced.

Why prioritize this

A CVSS 6.4 MEDIUM score reflects the vulnerability's limited attack surface (requires authentication) but broad impact scope (cross-site nature). Prioritize patching if your site has multiple Contributor accounts, external contributors, or if users with those permissions work in untrusted network environments. This is not an emergency but should be remediated within 2–4 weeks as part of regular security maintenance.

Risk score, explained

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N vector yields a base score of 6.4 (MEDIUM). The score reflects: network-based attack vector (AV:N), low attack complexity (AC:L), requirement for low-privilege authentication (PR:L), no user interaction needed (UI:N), and impact confined to confidentiality and integrity of users' sessions—not availability or the plugin/server itself. The scope change (S:C) elevates the score because injected scripts affect not just the attacker's session but other site visitors' browsers.

Frequently asked questions