Events Made Easy: Cross-Site Scripting via content injection

Summary

The WordPress plugin Events Made Easy up to and including 3.3.5 contains a content injection vulnerability (CWE-80, cross-site scripting). According to Patchstack, an unauthenticated attacker can add unwanted content to pages, such as ads, scam pages or malware links. The CVSS score is 5.3 (medium). CISA SSVC rates exploitation as none and automatable as yes.

Affected

• Events Made Easy WordPress plugin, versions 0 through 3.3.5

Fixed in

• Version 3.3.6 or later (per the CVE record and Patchstack; publication on WordPress.org not confirmed at the time of research)

Workaround

Unknown. No vendor-published workaround found. Interim measures: limit accounts with contributor-level or higher access and verify that event data is escaped on pages that display it.

Exploitation

• No known exploitation at the time of publication
• Not listed in CISA KEV
• No public proof of concept found

Our recommendation

• Update Events Made Easy to version 3.3.6 or later in the normal patch cycle, after verifying the release on WordPress.org.
• Inventory WordPress sites running this plugin and check the installed version.
• Review other recent XSS CVEs for this plugin on the same installations.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory: WordPress Events Made Easy plugin <= 3.3.5 Content Injection patchstack.com
• CVE Record CVE-2026-124255 www.cve.org
• Events Made Easy on WordPress.org wordpress.org
• Strix AI CVE details CVE-2026-124255 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:50.