Threats tagged 'ghsa-c58x-hvfg-9vjh'

CVE-2026-16063 is a cross-site scripting (XSS) vulnerability in the Event Booking Manager for WooCommerce WordPress plugin versions before 5.3.7. It allows users with Author role or higher to inject arbitrary JavaScript into event timeline content, which is then executed in the browsers of visitors viewing the event page, including administrators. This vulnerability arises because the plugin does not properly sanitize or escape user-submitted content before storing and rendering it publicly.