CVE-2026-17089 describes a reflected Cross-Site Scripting vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin by netweblogic. The flaw exists because the 'header_format' parameter is sanitized when used in the shortcode entry point via wp_kses(), but this sanitization is bypassed in the unauthenticated 'search_events_grouped' AJAX action. The unsanitized parameter is then echoed into the HTML body in the output_grouped() function, enabling injection of arbitrary web scripts. This vulnerability affects all versions up to and including 7.4.0.1.

An unauthenticated attacker can inject malicious scripts that execute in the context of a victim's browser if the victim is tricked into clicking a crafted link. This can lead to limited confidentiality and integrity impacts such as theft of cookies or session tokens and manipulation of displayed content. The CVSS v3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious links that might exploit this vulnerability. Monitoring vendor channels for updates and applying patches promptly once released is recommended.