CVE-2026-60119

Name of the Vulnerable Software and Affected Versions Hi.Events versions prior to 1.11.0

Description Authenticated attackers with event creation or edit permissions can perform cross-site scripting by embedding a malicious event title containing the </script> sequence. This occurs because the sequence is not escaped by JSON.stringify() when embedded in inline script tags. This allows the attacker to break out of the script context within the application/ld+json structured data block or server-side rehydrated state, executing arbitrary HTML and JavaScript in the browser of any user viewing the public event page, including unauthenticated visitors and administrators.

Recommendations Update to version 1.11.0 or later.