CVE-2026-2387 Overview
CVE-2026-2387 is a Stored Cross-Site Scripting (XSS) vulnerability in the Event Organiser plugin for WordPress. The flaw affects all plugin versions up to and including 3.12.9. The eo_events shortcode accepts attacker-controlled no_events content and renders it in event list templates without output escaping. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any visitor who accesses the affected page, enabling session theft, forced redirects, or content manipulation [CWE-79].
Critical Impact
Contributor-level accounts can persist JavaScript payloads that execute against site visitors and administrators, enabling account takeover through session or cookie theft.
Affected Products
- Event Organiser plugin for WordPress, versions up to and including 3.12.9
- WordPress installations using the eo_events shortcode
- Sites permitting Contributor-level or higher user registration
Discovery Timeline
- 2026-07-01 - CVE-2026-2387 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-2387
Vulnerability Analysis
The vulnerability resides in the shortcode handler for eo_events. The handler exposes a no_events attribute that lets authors specify the content rendered when a query returns no matching events. The plugin passes this attribute value directly into the event list template output without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses_post(). Any HTML or JavaScript supplied through the attribute is emitted verbatim into the page markup.
Contributors in WordPress can submit posts containing shortcodes for review. When an editor or administrator previews or publishes the content, the malicious shortcode renders and the injected script executes in their authenticated browser session. This creates a privilege escalation path from Contributor to Administrator through cookie theft or forced administrative actions.
Root Cause
The root cause is missing output encoding on user-controlled shortcode attributes. The plugin trusts the no_events attribute value and concatenates it into HTML output. WordPress requires plugins to escape all dynamic data at the point of output, and this control was absent in the affected code path.
Attack Vector
An attacker registers or compromises a Contributor-level account. The attacker authors a post containing an eo_events shortcode with a no_events attribute carrying a JavaScript payload. When any user visits a page rendering that shortcode where the event query returns no results, the payload executes in their browser. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-2387
Indicators of Compromise
- Posts or pages containing eo_events shortcodes with no_events attribute values that include <script>, onerror=, onload=, or javascript: strings
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing plugin-rendered pages
- New administrator accounts or modified user roles created shortly after Contributor content is reviewed
Detection Strategies
- Audit the wp_posts table for shortcode content matching eo_events combined with HTML event handler attributes or script tags
- Review Contributor and Author submissions containing shortcodes before publication
- Enable server-side logging of rendered shortcode attributes for retrospective analysis
Monitoring Recommendations
- Deploy a web application firewall rule that blocks shortcode attributes containing script tags or JavaScript URI schemes
- Monitor WordPress user role changes and administrator authentication events
- Track browser Content Security Policy violation reports for administrator sessions
How to Mitigate CVE-2026-2387
Immediate Actions Required
- Update the Event Organiser plugin to a version later than 3.12.9 that contains the fix referenced in WordPress Event Organiser Update
- Audit all existing posts and pages using the eo_events shortcode for suspicious no_events attribute content
- Review Contributor, Author, and Editor accounts for unauthorized or dormant users
Patch Information
The vendor patched the vulnerability in the changeset published at WordPress Event Organiser Update. The fix applies proper output escaping to the no_events shortcode attribute before rendering.
Workarounds
- Restrict Contributor-level and higher account creation to trusted users only
- Disable the Event Organiser plugin until the patched version is deployed
- Implement a Content Security Policy that blocks inline script execution on pages rendering the affected shortcode
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
