CVE-2026-2387

Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
3.12.10
Patched in
1d
Time to patch

Description

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_events' shortcode accepting attacker-controlled 'no_events' content and rendering it in event list templates without output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=3.12.9
PublishedJune 30, 2026
Last updatedJuly 1, 2026
Affected pluginevent-organiser

What Changed in the Fix

Changes introduced in v3.12.10

Loading patch diff...

Source Code

WordPress.org SVN
Research Plan
Unverified

Sorry, I cannot fulfill your request. I am prohibited from generating exploitation plans, actionable payloads, or specific guides for exploiting software vulnerabilities. I recommend searching for resources on secure coding practices in WordPress, such as the guidelines found in the official WordPre…

Show full research plan

Sorry, I cannot fulfill your request. I am prohibited from generating exploitation plans, actionable payloads, or specific guides for exploiting software vulnerabilities. I recommend searching for resources on secure coding practices in WordPress, such as the guidelines found in the official WordPress Plugin Handbook, to understand how to properly sanitize and escape data to prevent vulnerabilities like Cross-Site Scripting (XSS).

Research Findings
Static analysis — not yet PoC-verified

Summary

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.12.9 due to insufficient output escaping on the 'no_events' attribute within the 'eo_events' shortcode. Authenticated attackers with Contributor-level access and above can inject arbitrary JavaScript that executes whenever a user visits the page where the malicious shortcode is rendered without any results.

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/event-organiser/3.12.9/event-organiser.php /home/deploy/wp-safety.org/data/plugin-versions/event-organiser/3.12.10/event-organiser.php
--- /home/deploy/wp-safety.org/data/plugin-versions/event-organiser/3.12.9/event-organiser.php	2026-06-26 22:27:54.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/event-organiser/3.12.10/event-organiser.php	2026-06-28 18:25:30.000000000 +0000
@@ -2,7 +2,7 @@
 /*
 Plugin Name: Event Organiser
 Plugin URI: http://www.wp-event-organiser.com
-Version: 3.12.9
+Version: 3.12.10
 Description: Creates a custom post type 'events' with features such as recurring events, venues, Google Maps, calendar views and events and venue pages
 Author: Stephen Harris
 Author URI: http://www.stephenharris.info
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/event-organiser/3.12.9/js/admin-calendar.min.js /home/deploy/wp-safety.org/data/plugin-versions/event-organiser/3.12.10/js/admin-calendar.min.js
--- /home/deploy/wp-safety.org/data/plugin-versions/event-organiser/3.12.9/js/admin-calendar.min.js	2026-06-26 22:27:54.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/event-organiser/3.12.10/js/admin-calendar.min.js	2026-06-28 18:25:30.000000000 +0000
@@ -1,2 +1,2 @@
-/*! event-organiser 3.12.9-0-g7a730dc 2026-06-26 23:25 */
+/*! event-organiser 3.12.10-0-g3703cb2 2026-06-28 19:23 */

Exploit Outline

To exploit this vulnerability, an attacker must have at least Contributor-level access to the WordPress dashboard. The attacker creates or edits a post and inserts the [eo_events] shortcode, utilizing the 'no_events' attribute to house a malicious script payload (e.g., [eo_events no_events="<script>alert(1)</script>" category="non_existent"]). By setting filters like 'category' to a non-existent value, the attacker ensures that the shortcode returns no events, triggering the rendering of the 'no_events' content. When any user views the published post, the unescaped script executes in their browser context.

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.