Stephen Harris vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Stephen Harris products: 2 record(s), with severity, exploitation and fixes.

Event Organiser 2

Exploited only (KEV) →

CVE-2026-2387 Medium · 6.4 CWE-79 Jul 1, 2026

Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_events' shortcode accepting attacker-controlled 'no_events' content and rendering it in event list templates without output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-69012 Medium · 4.3 CWE-862 Dec 30, 2025

WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.