CVE-2026-16063 is a CWE-79 Cross-Site Scripting vulnerability in the Event Booking Manager for WooCommerce WordPress plugin. Versions prior to 5.3.7 do not sanitize or escape event timeline content submitted by users with post-editing access before storing and rendering it on public event pages. This flaw enables users with the Author role or higher to inject arbitrary JavaScript that executes in the browsers of any visitor viewing the event page, potentially leading to session hijacking, defacement, or other malicious actions within the context of the affected site.

The vulnerability allows users with Author role or higher to execute arbitrary JavaScript in the browsers of visitors, including administrators, who view the event pages. This can lead to unauthorized actions such as session hijacking, theft of sensitive information, or manipulation of the website content. The impact is limited to users who have post-editing access and the visitors of the event pages, but it can compromise site integrity and user trust.

No official patch or remediation has been confirmed yet for this vulnerability. Users should monitor the vendor's advisory for updates and apply the official fix once available. Until then, restrict post-editing permissions to trusted users only and consider disabling or limiting the use of the event timeline feature to reduce exposure.