CVE-2026-16063
Received Received - Intake

Event Timeline XSS in Event Booking Manager for WooCommerce

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: WPScan

Description
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-16063
EUVD
EUVD-2026-51949

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_event_booking_manager event_booking_manager to 5.3.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the Event Booking Manager for WooCommerce WordPress plugin. It allows users with Author role or higher to inject malicious JavaScript into event timeline content. The injected code executes when other users, including administrators, view the affected event page.

Detection Guidance

Check for unauthorized JavaScript in event timeline content by inspecting the WordPress admin panel under Events. Look for suspicious scripts in the timeline editor or public event pages. Review user roles with Author access or higher for unexpected changes.

Impact Analysis

Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of logged-in users. Administrators viewing compromised pages risk complete account compromise, including potential site takeover or data theft.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized JavaScript injection through event timeline content. This may lead to data exfiltration, unauthorized access to user sessions, or manipulation of displayed information, which are critical risks under these regulations.

Mitigation Strategies

Update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later. Remove or restrict Author role access to event timeline editing. Scan for and remove any injected JavaScript from event timelines. Consider using a security plugin to monitor for similar issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart