What’s Vulnerable › Vulnerabilities
CVE-2026-6268: EventPress < 22.2 – Reflected Cross-Site Scripting
- Severity: high (CVSS 7.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-27 · updated 2026-06-17
- Weakness: CWE-79
Description
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
Affected products
- EventPress: before 22.2 — fixed in 22.2
How to fix
Upgrade to a fixed version: EventPress 22.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-6268 or the next vulnerability affects your stack