CVE-2026-32449

The Themify Event Post plugin for WordPress versions up to and including 1.3.4 contains a stored cross-site scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript code that is stored on the server and executed when other users access the affected page.

Exploitation requires a privileged user to perform an action, such as clicking a malicious link or visiting a crafted page, which triggers the injection [1]. Once injected, the malicious script executes in the context of the victim's browser when they view the compromised content.

Successful exploitation can lead to a range of impacts, including redirecting visitors to malicious sites, displaying unwanted advertisements, or injecting other HTML payloads [1]. This vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites regardless of their size or popularity.

Users are strongly advised to update the plugin to version 1.3.5 or later, which resolves the issue [1]. Patchstack users can enable auto-updates for vulnerable plugins to ensure timely protection.