Event Booking Manager for WooCommerce < 5.3.7 – Author+ Stored XSS via Event Timeline Content | CVE 2026-16063

Description

The plugin does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page, allowing users with the Author role and above to inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.

Proof of Concept

Prerequisites: WooCommerce + Event Booking Manager for WooCommerce (<= 5.3.6) active; an Author account.

1. Log in as the Author and open (or create) an Event in the standard WordPress editor:
     /wp-admin/post.php?post=<EVENT_ID>&action=edit
   The "...Information" metabox renders the mpwem_type_nonce hidden field and the Event
   Timeline fields (mep_day_title[], mep_day_time[], mep_day_content[]).

2. In the Event Timeline tab, set a Day title/time and put this in the Day content:
     <script>alert(document.domain)</script>
   Publish/Update the event. (Equivalent raw request: POST /wp-admin/post.php with
   action=editpost, post_ID=<EVENT_ID>, the editor _wpnonce, mpwem_type_nonce,
   mep_day_title[0], mep_day_time[0], and
   mep_day_content[0]=<script>alert(document.domain)</script>.)

3. As an unauthenticated visitor, load the public event page (e.g. /events/<event-slug>/).
   The <script> tag is rendered raw in the timeline area and executes on page load.