CVE-2026-66457 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Events Manager versions up to 7.4.1. The vulnerability allows remote attackers to inject malicious scripts that execute in the context of the victim's browser, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS vector indicates the attack can be performed remotely without privileges, with low attack complexity, requiring user interaction, and resulting in a scope change.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of users' browsers, potentially leading to data disclosure, modification, or disruption of service. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor vendor communications for updates and apply patches once available.