Wp Event Aggregator
Approved changes feed: RSS · Atom
cpe:2.3:a:xylus:wp_event_aggregator:_import_eventbrite_events,_meetup_events,_social_events_and_any_ical_events_into_event_calendar:*:*:*:*:*:*:*:*
part: a version: _import_eventbrite_events,_meetup_events,_social_events_and_any_ical_events_into_event_calendar update: *
| Vendor | Xylus (3851cd9f-a5d4-5bfe-b432-a00c4e1a682a) |
|---|---|
| Product | Wp Event Aggregator (350cba6b-08e4-5489-8c87-86d68d20d51e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1941 |
vulnerable | 2026-06-08 07:49:09.881935 |
WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
MEDIUM (6.4)
The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-02-18T08:26:03.081Z
Updated: 2026-04-08T16:52:25.182Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.