CVE-2026-114694: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Pixelite Events Manager

The vulnerability CVE-2026-114694 in Pixelite Events Manager (versions >=0 and <7.4.9) is a reflected Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that execute when a user visits a crafted URL or page, potentially leading to information disclosure, session hijacking, or other impacts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and partial impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, resulting in partial loss of confidentiality, integrity, and availability of user data within the affected application context. This can facilitate session hijacking, information disclosure, or manipulation of web content. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates and apply patches promptly once released.