Event post WordPress plugin: Stored cross-site scripting
Summary
The Event post WordPress plugin up to and including version 6.1.2 contains a stored cross-site scripting (XSS) vulnerability (CWE-79). An authenticated user with low privileges, such as Contributor, can store malicious scripts that run in the browsers of other users, for example when a privileged user performs an action such as opening a crafted page or submitting a form. Successful exploitation can allow theft of visitor data or account hijacking.
Affected
- Event post WordPress plugin, versions 0 through 6.1.2
Fixed in
- Version 6.1.3 (according to the CVE record and Patchstack; not yet confirmed on WordPress.org at the time of research)
Workaround
- No official workaround known.
- If an update is not possible at once, deactivate the plugin or restrict Contributor and higher roles to trusted users only.
Exploitation
- No public exploit code known.
- Not listed in CISA KEV.
- No reports of active exploitation.
Our recommendation
- Identify all WordPress sites running Event post and record their versions.
- Update to version 6.1.3 or later after confirming the version on WordPress.org or with the vendor.
- Until patched, review accounts with Contributor or higher rights and remove unneeded ones.
- Check existing event posts and event fields for unexpected script or HTML content.
- Re-check NVD, CISA KEV and the Patchstack advisory in a few days, as the status is still deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125781 www.cve.org
- Patchstack advisory patchstack.com
- OffSeq threat radar radar.offseq.com
- Strix CVE-2026-125781 www.strix.ai
- WordPress.org plugin changelog wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:38.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Stored XSS.This issue affects Event post: from n/a through 6.1.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.