CVE-2026-6268

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-626807.1Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves re CVE-2026-626819.3Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped back CVE-2026-626829.3Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped back CVE-2026-626833.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-626842.7File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-626858.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-626875.5Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose informatio CVE-2026-626887.8Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.CVE-2026-62695.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.CVE-2026-626907.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authoriz CVE-2026-626927.8Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-626937.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows MIDI Service Module allows an authori