CVE-2026-17089 Overview
CVE-2026-17089 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress. The flaw affects all versions up to and including 7.4.0.1. Unauthenticated attackers can inject arbitrary JavaScript via the header_format parameter when a victim clicks a crafted link. The shortcode entry point sanitizes input through wp_kses(), but the unauthenticated search_events_grouped AJAX action bypasses this sanitization before the value is echoed in output_grouped().
Critical Impact
Unauthenticated attackers can execute arbitrary scripts in a victim's browser session, enabling session theft, forced administrative actions, and site defacement when a targeted user clicks a malicious link.
Affected Products
- Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin, all versions through 7.4.0.1
- Fixed in version 7.4.1
- WordPress sites exposing the plugin's public AJAX endpoints
Discovery Timeline
- 2026-08-25 - CVE-2026-17089 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-17089
Vulnerability Analysis
The vulnerability resides in the plugin's event listing rendering logic. The header_format parameter controls HTML output prepended to grouped event results. When invoked through a WordPress shortcode, the plugin applies wp_kses() to strip disallowed tags and attributes from header_format. This sanitization does not extend to the AJAX pathway that reaches the same rendering function.
The unauthenticated search_events_grouped AJAX action reads header_format directly from the request and forwards it to output_grouped(). The function echoes the parameter into the HTML response body without sanitization or output escaping. An attacker crafts a URL containing script payloads in header_format and delivers it via phishing, forum posts, or third-party sites. When a logged-in user or administrator loads the link, the injected script executes in their browser context.
Root Cause
The root cause is inconsistent input handling across entry points that share a common rendering function. Sanitization was applied at the shortcode layer rather than centralized inside output_grouped(). The AJAX handler in em-actions.php (lines 891 and 920) invokes the renderer without replicating the wp_kses() filter, leaving the parameter to reach the DOM as attacker-controlled markup.
Attack Vector
Exploitation requires user interaction. An attacker constructs a URL targeting the admin-ajax.php endpoint with action=search_events_grouped and a malicious header_format value. The victim must click the link or load an attacker-controlled page that issues the request. Because the endpoint is unauthenticated, no prior session on the target site is required beyond the victim's own. Reflected script execution then occurs under the origin of the vulnerable WordPress site.
See the Wordfence Vulnerability Report and the plugin source at em-actions.php line 891 for the vulnerable code paths.
Detection Methods for CVE-2026-17089
Indicators of Compromise
- HTTP requests to admin-ajax.php containing action=search_events_grouped combined with a header_format parameter that includes <script, onerror=, onload=, or javascript: substrings.
- Referrer headers pointing to external domains for requests carrying suspicious header_format payloads.
- Web server logs showing URL-encoded angle brackets (%3Cscript) or event handlers in query strings targeting the plugin endpoint.
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects header_format values for HTML tags or JavaScript event handlers and blocks non-conforming requests.
- Alert on outbound traffic from user sessions to unusual domains shortly after loading pages containing search_events_grouped responses.
- Correlate WordPress access logs with authentication events to identify administrators who loaded crafted URLs.
Monitoring Recommendations
- Enable verbose logging on admin-ajax.php and archive request bodies for at least 90 days for retrospective hunting.
- Monitor plugin version inventory across WordPress installations and flag any host still running Events Manager 7.4.0.1 or earlier.
- Track anomalous cookie access patterns and administrative actions that follow AJAX responses from the plugin.
How to Mitigate CVE-2026-17089
Immediate Actions Required
- Upgrade the Events Manager plugin to version 7.4.1 or later on every WordPress site.
- Audit administrator accounts for unauthorized changes, new users, or modified plugin files following suspected exploitation.
- Rotate active WordPress session cookies and force re-authentication for privileged users.
Patch Information
The vendor addressed the issue in Events Manager 7.4.1. The fix is visible in the version diff between 7.4.0.1 and 7.4.1. Site owners should apply the update through the WordPress plugin manager or via WP-CLI. Confirm the installed version reports 7.4.1 after the update completes.
Workarounds
- Restrict access to admin-ajax.php at the WAF or reverse proxy for the search_events_grouped action until patching is complete.
- Disable the Events Manager plugin on internet-facing sites that cannot be updated immediately.
- Add a Content Security Policy (CSP) header that disallows inline scripts to reduce the impact of reflected payloads.
# Update Events Manager via WP-CLI
wp plugin update events-manager --version=7.4.1
wp plugin list --name=events-manager --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
