01 Record

CVE-2026-17089

Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

MediumPUBLISHEDCNA: Wordfence

CNA base score6.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

View raw JSON

02 Description

Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Not recorded
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-25 03:27Z43 MIN AGO

Last updated

2026-08-25 03:27Z43 MIN AGO

Reserved

2026-07-24

Assigning CNA

Wordfence

Record state

PUBLISHED

Severity

Medium (CVSS 6.1)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

Data version

5.2

Document digest

147a457fde61481945a0ab2f270fd5f4d00e53f1ce8da1b869189139568df9be

05 Affected products

VendorProductVersionsPlatforms

netweblogicEvents Manager – Calendar, Bookings, Tickets, and more!0 to 7.4.0.1—

06 References

www.wordfence.comhttps://www.wordfence.com/threat-intel/vulnerabilities/id/a56d1a9e-7564-41b0-af03-c272ffbbbb97?source=cve
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/events-manager/tags/7.3.4/classes/em-events.php#L469
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/events-manager/tags/7.4.0.1/classes/em-events.php#L469
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/events-manager/tags/7.4.0.1/classes/em-object.php#L1176
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/events-manager/tags/7.4.0.1/em-actions.php#L891
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/events-manager/tags/7.4.0.1/em-actions.php#L920
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/events-manager/tags/7.3.4/classes/em-object.php#L1176
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/events-manager/tags/7.3.4/em-actions.php#L891
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/browser/events-manager/tags/7.3.4/em-actions.php#L920
plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset?old_path=/events-manager/tags/7.4.0.1&new_path=/events-manager/tags/7.4.1

CVE-2026-17089

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Description

03 Metadata

04 Affected products

05 References

CVE-2026-17089

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References