CVE-2026-16063

Received Received - Intake

Event Timeline XSS in Event Booking Manager for WooCommerce

Publication date: 2026-08-02

Last updated on: 2026-08-03

Assigner: WPScan

Description

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-02

Last Modified

2026-08-03

Generated

2026-08-22

AI Q&A

2026-08-02

EPSS Evaluated

2026-08-21

NVD

CVE-2026-16063

EUVD

EUVD-2026-51949

Affected Vendors & Products

Vendor	Product	Version / Range
wp_event_booking_manager	event_booking_manager	to 5.3.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the Event Booking Manager for WooCommerce WordPress plugin. It allows users with Author role or higher to inject malicious JavaScript into event timeline content. The injected code executes when other users, including administrators, view the affected event page.

Detection Guidance

Check for unauthorized JavaScript in event timeline content by inspecting the WordPress admin panel under Events. Look for suspicious scripts in the timeline editor or public event pages. Review user roles with Author access or higher for unexpected changes.

Impact Analysis

Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of logged-in users. Administrators viewing compromised pages risk complete account compromise, including potential site takeover or data theft.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized JavaScript injection through event timeline content. This may lead to data exfiltration, unauthorized access to user sessions, or manipulation of displayed information, which are critical risks under these regulations.

Mitigation Strategies

Update the Event Booking Manager for WooCommerce plugin to version 5.3.7 or later. Remove or restrict Author role access to event timeline editing. Scan for and remove any injected JavaScript from event timelines. Consider using a security plugin to monitor for similar issues.

Hi! I’m here to help you understand CVE-2026-16063. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70