CVE-2026-8898

Vulnerability

The Events In City plugin for WordPress versions up to and including 3.0 contains a stored cross-site scripting (XSS) vulnerability in the org_event_scode() function, which handles the [org-events] shortcode. The function fails to sanitize user-supplied attributes such as organizer_id, width, height, transparency, header, border, and layout before concatenating them directly into HTML attributes without using esc_attr(). This allows authenticated attackers with at least contributor-level access to inject arbitrary JavaScript.

Exploitation

An attacker must have a WordPress account with contributor-level privileges or higher. They can insert the [org-events] shortcode into a post or page and provide malicious payloads in the vulnerable attributes (e.g., organizer_id, width). The injected script will be stored in the database and executed when any user views the affected page.

Impact

Successful exploitation leads to stored XSS, enabling the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can result in session hijacking, defacement, redirection to malicious sites, or theft of sensitive information such as cookies and authentication tokens.

Mitigation

As of the publication date (2026-05-27), no patched version has been released. Users should disable the plugin or restrict contributor-level access until a fix is available. The vendor has not yet provided an update. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.