Medium severity6.1NVD Advisory· Published Jul 13, 2021· Updated Jun 17, 2026

CVE-2020-26153

Description

A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Event Espresso Decafllm-create
Range: <4.10.7.p
Package: https://wordpress.org/plugins/event-espresso-decaf

Patches

Vulnerability mechanics

References

github.com/eventespresso/event-espresso-core/compare/4.10.6.p...4.10.7.pnvdPatchThird Party Advisory
labs.nettitude.com/blog/cve-2020-26153-event-espresso-core-cross-site-scripting/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000