This vulnerability (CVE-2026-81791) is classified as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting (XSS). It affects EventON versions up to 2.5.7. The flaw allows a subscriber-level user to inject malicious scripts that could be executed in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges at the subscriber level, user interaction required, and scope changed, with low impact on confidentiality and integrity and low impact on availability.

An attacker with subscriber privileges can exploit this XSS vulnerability to execute arbitrary scripts in the context of other users. This could lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, the impact is limited by the requirement for the attacker to have subscriber-level access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, consider restricting subscriber input or applying web application firewall (WAF) rules to detect and block XSS payloads where feasible.