This vulnerability (CVE-2026-28162) is an unauthenticated Cross Site Scripting (XSS) flaw in Events Made Easy software versions up to 3.2.5. It allows attackers to inject malicious scripts without authentication, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation can lead to execution of arbitrary scripts in the context of other users, potentially resulting in partial loss of confidentiality, integrity, and availability of the affected system or user data. The vulnerability is exploitable remotely without authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available. Users should monitor vendor communications for updates and consider applying any forthcoming patches promptly.