Vulnerabilities

TI-2026-02022 CVE-2026-2387 · GHSA-fmmj-9298-j37p

Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode

LOW 28

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00261 Published 2026-07-01 No fix listed CWE-79

TI-2025-42467 CVE-2025-69012 · GHSA-j3cj-45v4-mx53

WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00244 Published 2025-12-30 No fix listed CWE-862

Vulnerabilities

Filters

Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode

WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability