WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
medium
The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Co...
- CVSS:
- 6.4
- Affected:
- up to 1.8.7
- Fixed in:
- 1.9.0
- Disclosed:
- Feb 17, 2026
CVE-2026-1941 on NVD →
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into WordPress [wp-event-aggregator] < 1.8.3
unknown
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Reflected XSS. This issue affects WP Event Aggregator: from n/a through 1.8.2.
- Affected:
- up to 1.8.3
- Fixed in:
- 1.8.3
- Disclosed:
- Feb 14, 2025
CVE-2025-24700 on NVD →
WP Event Aggregator <= 1.8.2 - Reflected Cross-Site Scripting
medium
The WP Event Aggregator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successf...
- CVSS:
- 6.1
- Affected:
- up to 1.8.2
- Fixed in:
- 1.8.3
- Disclosed:
- Feb 1, 2025
CVE-2025-24700 on NVD →
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into WordPress [wp-event-aggregator] < 1.8.0
unknown
[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.
- Affected:
- up to 1.8.0
- Fixed in:
- 1.8.0
- Disclosed:
- Jul 20, 2024
CVE-2024-38703 on NVD →
WP Event Aggregator <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...
- CVSS:
- 6.4
- Affected:
- up to 1.7.9
- Fixed in:
- 1.8.0
- Disclosed:
- Jul 11, 2024
CVE-2024-38703 on NVD →
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into WordPress [wp-event-aggregator] < 1.7.7
unknown
[en] Cross-Site Request Forgery (CSRF) vulnerability in Xylus Themes WP Event Aggregator.This issue affects WP Event Aggregator: from n/a through 1.7.6.
- Affected:
- up to 1.7.7
- Fixed in:
- 1.7.7
- Disclosed:
- Apr 12, 2024
CVE-2024-31371 on NVD →
WP Event Aggregator <= 1.7.6 - Cross-Site Request Forgery via wpea_deauthorize_user()
medium
The WP Event Aggregator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the wpea_deauthorize_user() function. This makes it possible for unauthenticated attackers to remove a meetup connection via a forged...
- CVSS:
- 4.3
- Affected:
- up to 1.7.6
- Fixed in:
- 1.7.7
- Disclosed:
- Apr 9, 2024
CVE-2024-31371 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database