High severity7.1NVD Advisory· Published May 27, 2026· Updated May 27, 2026
CVE-2026-6268
CVE-2026-6268
Description
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<22.2+ 1 more
- (no CPE)range: <22.2
- (no CPE)range: <22.2
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (June 8, 2026 to June 14, 2026)Wordfence Blog · Jun 18, 2026