CVE-2026-17089: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in netweblogic Events Manager – Calendar, Bookings, Tickets, and more!

CVE-2026-17089 describes a reflected cross-site scripting vulnerability in the Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin by netweblogic. The flaw exists in the 'header_format' parameter, which is sanitized via wp_kses() in the shortcode entry point but is unsanitized in the unauthenticated 'search_events_grouped' AJAX action. This unsanitized input is echoed into the HTML body in output_grouped(), enabling script injection. The vulnerability affects all plugin versions up to and including 7.4.0.1.

An unauthenticated attacker can inject arbitrary web scripts via the 'header_format' parameter in the vulnerable AJAX action. This can lead to execution of malicious scripts in the context of users who interact with crafted links or content, potentially resulting in information disclosure or session hijacking. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the 'search_events_grouped' AJAX action or implement web application firewall rules to block malicious payloads targeting the 'header_format' parameter. Monitor vendor communications for updates and apply patches promptly once released.