CVE-2026-116394

Name of the Vulnerable Software and Affected Versions WpEvently versions prior to 5.8.0

Description The plugin is susceptible to HTML injection and code injection due to improper neutralization of script-related HTML tags. This occurs because the mep submit rsvp AJAX action fails to perform post-type and member-only authorization checks and uses a generic, event-agnostic nonce mep rsvp nonce that can be obtained from public event pages. Consequently, unauthenticated attackers can inject arbitrary HTML content via the attendee fields POST data, which may then be rendered in the administration interface or confirmation output.

Recommendations Update to a version later than 5.7.9.