CVE-2020-26153

MEDIUM NUCLEI

Event Espresso Core < 4.10.7.p - Cross-Site Scripting via Page Parameter

Title source: llm

Exploitation Summary

CVE-2020-26153 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

Nuclei Templates (1)

Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting

MEDIUMby pikpikcu

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://github.com/eventespresso/event-espresso-core/compare/4.10.6.p...4.10.7.p

Exploit, Third Party Advisory x_refsource_misc

https://labs.nettitude.com/blog/cve-2020-26153-event-espresso-core-cross-site-scripting/

Scores

CVSS v3 6.1

EPSS 0.0380

EPSS Percentile 88.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

eventespresso/event_espresso < 4.10.7.p

Published Jul 13, 2021

Tracked Since Feb 18, 2026