PT-2026-43496 · WordPress · Eventpress

Mustafa Ahmed · Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-6268

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions EventPress versions prior to 22.2

Description The EventPress WordPress theme fails to sanitize or escape the id parameter within the 'eventpress customizer notify dismiss action' AJAX handler. This allows unauthenticated attackers to execute Reflected Cross-Site Scripting (XSS) attacks against logged-in users by outputting the unsanitized input back in the response.

Recommendations Update to version 22.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6268

Affected Products

Eventpress

References · 3

• 🔥 https://wpscan.com/vulnerability/77192aeb-8e4b-4057-b5d7-2b95da634edd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6268 · Security Note
• https://t.me/cveNotify/164801 · Telegram Post