IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-05-27 07:16

MODIFIED

2026-05-27 07:16

EPSS (Prob. Exploit)

0.28%

Top 80.3%

DATA SOURCES:

NVD 🔗 2026-05-27 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-29

> DESCRIPTION

The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-fg9p-mrxr-hvq7 CRITICAL

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

AFFECTED PACKAGES:

NPM / orval

< 8.21.0

Fixed in: 8.21.0

> HISTORIQUE DES MODIFICATIONS

Première apparition

27/05/2026 07:16

Source: NVD

Total des modifications: 0 Dernière mise à jour: 5 months ago

> REFERENCES