CVE-2026-2387

MEDIUM

Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-2387. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-2387, a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Event Organiser plugin (versions up to and including 3.12.9). The code includes placeholder logic for target probing but lacks actual exploit implementation for the XSS vulnerability.

Description

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_events' shortcode accepting attacker-controlled 'no_events' content and rendering it in event list templates without output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-2387_the_event_organiser.py

This repository contains an auto-generated stub module for CVE-2026-2387, a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress Event Organiser plugin (versions up to and including 3.12.9). The code includes placeholder logic for target probing but lacks actual exploit implementation for the XSS vulnerability.

Classification
Stub 99%
Attack Type
Xss
Complexity
Moderate
Reliability
Theoretical
Target: WordPress Event Organiser plugin <= 3.12.9
No auth needed
Prerequisites: Target must have the vulnerable Event Organiser plugin installed · Attacker must have access to a WordPress post/page where the 'eo_events' shortcode can be injected
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 6.4
EPSS 0.0015
EPSS Percentile 4.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
stephenharris/Event Organiser < 3.12.9
Published Jul 01, 2026
Tracked Since Jul 01, 2026