PT-2026-58094 · WordPress · Hi.Events

Adam Młynarczyk · CVE-2026-60119 · Published 2026-07-14 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hi.Events versions prior to 1.11.0

Description Authenticated attackers with event creation or edit permissions can perform cross-site scripting by embedding a malicious event title containing the </script> sequence. This occurs because the sequence is not escaped by JSON.stringify() when embedded in inline script tags. This allows the attacker to break out of the script context within the application/ld+json structured data block or server-side rehydrated state, executing arbitrary HTML and JavaScript in the browser of any user viewing the public event page, including unauthenticated visitors and administrators.

Recommendations Update to version 1.11.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-60119

GHSA-2GGX-79G6-2JMJ

Affected Products

Hi.Events

References · 9

• 🔥 https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2ggx-79g6-2jmj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60119.json · Exploit
• https://github.com/HiEventsDev/Hi.Events/commit/1e36b070771801ed7113255ef7b3a7f271a2a794 · Patch
• https://osv.dev/vulnerability/CVE-2026-60119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-60119 · Security Note
• https://github.com/HiEventsDev/Hi.Events · Note
• https://github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta · Note
• https://github.com/HiEventsDev/Hi.Events/pull/1260 · Note
• https://vulncheck.com/advisories/hi-events-beta-xss-via-event-title-json-stringify-injection · Note