Display Eventbrite Events plugin: Stored Cross-Site Scripting

Summary

The WordPress plugin Display Eventbrite Events by Fullworks, up to and including version 6.9.1, contains a stored Cross-Site Scripting (XSS) vulnerability. An authenticated user with low privileges can store malicious script that is rendered on the website. Exploitation requires a victim, such as a logged-in administrator or visitor, to interact with the crafted content, and the scope change means the script can affect more than the plugin itself.

Affected

• Display Eventbrite Events (slug widget-for-eventbrite-api) up to and including 6.9.1
• Required privilege level: Unknown (advisory not retrieved; sources indicate low privileges, possibly Contributor)

Fixed in

• Version 6.9.2 (according to the CVE record's solution text and Patchstack; not yet confirmed against the vendor changelog)

Workaround

• Unknown. No vendor-documented workaround found.
• Until updated, limit which accounts can add or edit content rendered by the plugin and review existing content for injected scripts.

Exploitation

• Not known to be exploited (OffSeq).
• KEV status: No (Strix).
• Public proof of concept: Unknown.

Our recommendation

• Update the Display Eventbrite Events plugin to version 6.9.2 or later, after confirming the fixed version on the Patchstack page or the WordPress.org changelog.
• Review which accounts hold contributor-type or higher roles and remove unneeded ones.
• Check existing event pages and widgets for unexpected scripts.
• Prioritise sites that use the plugin for ticket sales or have many contributor accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Strix CVE record mirror www.strix.ai
• OffSeq threat radar radar.offseq.com
• Patchstack vulnerability list for the plugin patchstack.com
• WordPress.org plugin page wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:28.