CVE-2026-17089

Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The shortcode entry point sanitizes 'header_format' via wp_kses(), but the unauthenticated 'search_events_grouped' AJAX action bypasses this sanitization entirely, leaving the parameter unsanitized before it is echoed into the HTML body in output_grouped().

We have discovered 34,621 live websites that are affected by CVE-2026-17089.

Run a Free Instant Scan



Affected Software

Product  Events Manager for WordPress
Category Wordpress Plugins
Vulnerable Domains34,621 live websites (98% of Events Manager for WordPress install base)
Vulnerable Versions
  • from 0 through 7.4.0.1
Vulnerable Versions Count107 versions ( 99% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 25, 2026
  • Updated - Aug 25, 2026

Credits

  • Wordfence PRISM (finder)

Website Distribution by Country

Number of websites using CVE-2026-17089
United States9,207 websites


Germany7,681 websites
France2,646 websites
Netherlands1,794 websites
GB1,776 websites
Italy1,404 websites
Switzerland1,028 websites
Canada838 websites
Denmark673 websites
Japan668 websites

Website Distribution by TLD

Number of websites using CVE-2026-17089
.com8,142 websites
.de6,008 websites
.org5,028 websites
.nl1,697 websites
.fr1,390 websites
.it1,081 websites
.ch900 websites
.co.uk765 websites
.net688 websites
.at613 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-17089

Top websites that are affected by CVE-2026-17089. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.org Switzerland**,***
****.org United States**,***
*********.*******.org United States**,***
**************.gov United States**,***
********.org United States**,***
*****.br Brazil**,***
****.org France**,***
*****.org United States**,***
***************.it Italy**,***
***********.*****.gov United States**,***
See full domain list

FAQ

CVE-2026-17089 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Events Manager for WordPress
A total of 34,621 websites have been identified as vulnerable to CVE-2026-17089, based on global website indexing conducted by WebTechSurvey.
The Events Manager for WordPress is affected by the CVE-2026-17089 vulnerability.
Events Manager for WordPress versions up to and including 7.4.0.1 are vulnerable to CVE-2026-17089.

References