CVE-2026-112844: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Arraytics WP Event Solution
Affects Arraytics WP Event SolutionSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:LWhat to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for official fixes.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| ArrayticsWP Event Solution | Affected
| Fixed in– |
Description
CVE-2026-112844 is a stored cross-site scripting (XSS) vulnerability in the Arraytics WP Event Solution plugin for WordPress. It affects versions from initial release up to 4.1.26. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in the context of users' browsers. This can lead to partial compromise of confidentiality, integrity, and availability. The CVSS score is 7.1, indicating a high severity. No vendor patch or remediation information is provided in the available data.