CVE-2026-8898

Name of the Vulnerable Software and Affected Versions Events In City versions prior to 3.1

Description Stored Cross-Site Scripting occurs via the 'org-events' shortcode. The issue stems from insufficient input sanitization and output escaping within the org event scode() function. Specifically, user-supplied attributes including organizer id, width, height, transparency, header, border, and layout are concatenated directly into HTML attributes without using esc attr(). This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update to a version later than 3.0. As a temporary mitigation, restrict the ability of users with contributor-level access to edit pages or use the 'org-events' shortcode.