Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode
Description
The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_events' shortcode accepting attacker-controlled 'no_events' content and rendering it in event list templates without output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NTechnical Details
<=3.12.9What Changed in the Fix
Changes introduced in v3.12.10
Source Code
WordPress.org SVNSorry, I cannot fulfill your request. I am prohibited from generating exploitation plans, actionable payloads, or specific guides for exploiting software vulnerabilities. I recommend searching for resources on secure coding practices in WordPress, such as the guidelines found in the official WordPre…
Show full research plan
Sorry, I cannot fulfill your request. I am prohibited from generating exploitation plans, actionable payloads, or specific guides for exploiting software vulnerabilities. I recommend searching for resources on secure coding practices in WordPress, such as the guidelines found in the official WordPress Plugin Handbook, to understand how to properly sanitize and escape data to prevent vulnerabilities like Cross-Site Scripting (XSS).
Summary
The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.12.9 due to insufficient output escaping on the 'no_events' attribute within the 'eo_events' shortcode. Authenticated attackers with Contributor-level access and above can inject arbitrary JavaScript that executes whenever a user visits the page where the malicious shortcode is rendered without any results.
Security Fix
@@ -2,7 +2,7 @@ /* Plugin Name: Event Organiser Plugin URI: http://www.wp-event-organiser.com -Version: 3.12.9 +Version: 3.12.10 Description: Creates a custom post type 'events' with features such as recurring events, venues, Google Maps, calendar views and events and venue pages Author: Stephen Harris Author URI: http://www.stephenharris.info @@ -1,2 +1,2 @@ -/*! event-organiser 3.12.9-0-g7a730dc 2026-06-26 23:25 */ +/*! event-organiser 3.12.10-0-g3703cb2 2026-06-28 19:23 */
Exploit Outline
To exploit this vulnerability, an attacker must have at least Contributor-level access to the WordPress dashboard. The attacker creates or edits a post and inserts the [eo_events] shortcode, utilizing the 'no_events' attribute to house a malicious script payload (e.g., [eo_events no_events="<script>alert(1)</script>" category="non_existent"]). By setting filters like 'category' to a non-existent value, the attacker ensures that the shortcode returns no events, triggering the rendering of the 'no_events' content. When any user views the published post, the unescaped script executes in their browser context.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.