Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
CVE-2026-1941 Stored XSS in WP Event Aggregator Plugin via 'wp_events' Shortcode https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1941
Post summary
CVE-2026-1941 is a stored XSS vulnerability in the WP Event Aggregator plugin's wp_events shortcode, with a link to a vulnerability details page but no PoC, exploit code, or patch mentioned.
CVE-2026-1941 The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and including, 1… https://www.cve.org/CVERecord?id=CVE-2026-1941
Post summary
The WP Event Aggregator plugin is vulnerable to stored XSS (CVE‑2026‑1941) in all versions up to 1.x, as documented on the CVE record.