CVE-2026-16063

Name of the Vulnerable Software and Affected Versions Event Booking Manager for WooCommerce versions prior to 5.3.7

Description Users with the Author role and above can perform a Stored Cross-Site Scripting (XSS) attack. This occurs because the plugin fails to sanitize or escape event timeline content submitted by users with post-editing access before it is stored and rendered on the public event page. Consequently, an attacker can inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.

Recommendations Update Event Booking Manager for WooCommerce to version 5.3.7 or later.