🔐 CVE Alert

CVE-2026-17089

MEDIUM 6.1

Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The shortcode entry point sanitizes 'header_format' via wp_kses(), but the unauthenticated 'search_events_grouped' AJAX action bypasses this sanitization entirely, leaving the parameter unsanitized before it is echoed into the HTML body in output_grouped().

CWE CWE-79
Vendor netweblogic
Product events manager – calendar, bookings, tickets, and more!
Published Aug 25, 2026
Stay Ahead of the Next One

Get instant alerts for netweblogic events manager – calendar, bookings, tickets, and more!

Be the first to know when new medium vulnerabilities affecting netweblogic events manager – calendar, bookings, tickets, and more! are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

netweblogic / Events Manager – Calendar, Bookings, Tickets, and more!
0 ≤ 7.4.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/a56d1a9e-7564-41b0-af03-c272ffbbbb97?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.3.4/classes/em-events.php#L469 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.4.0.1/classes/em-events.php#L469 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.4.0.1/classes/em-object.php#L1176 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.4.0.1/em-actions.php#L891 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.4.0.1/em-actions.php#L920 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.3.4/classes/em-object.php#L1176 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.3.4/em-actions.php#L891 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/events-manager/tags/7.3.4/em-actions.php#L920 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?old_path=/events-manager/tags/7.4.0.1&new_path=/events-manager/tags/7.4.1

Credits

Wordfence PRISM