CVE-2026-107649: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in liedekef Events Made Easy

CVE-2026-107649 is a stored cross-site scripting vulnerability in the Events Made Easy plugin for WordPress. It affects all versions up to 3.2.22 inclusive. The flaw is due to improper neutralization of input in the 'event[location_name]' parameter, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation is conditional on two administrative settings being enabled: guest event submission and forced location creation. The vulnerability can lead to script execution in the context of users visiting the injected pages.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the browsers of users who visit the injected pages. This can lead to information disclosure or session hijacking. The impact is limited by the requirement that specific plugin features be enabled, which are off by default. The CVSS score is 5.4 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

No official patch or fix is currently documented. Administrators should verify that the guest event submission and forced location creation features remain disabled if not required, as this prevents exploitation. Monitor the vendor's advisory channels for any forthcoming patches or updates addressing this vulnerability.