CVE-2026-1941

WP Event Aggregator <= 1.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The WP Event Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_events' shortcode in all versions up to, and including, 1.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

We have discovered 53 live websites that are affected by CVE-2026-1941.

Run a Free Instant Scan



Affected Software

Product  Wp Event Aggregator
Category Wordpress Plugins
Vulnerable Domains53 live websites (7.79% of Wp Event Aggregator install base)
Vulnerable Versions
  • from 0 through 1.8.7
Vulnerable Versions Count3 versions ( 33% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Feb 18, 2026
  • Updated - Apr 8, 2026

Credits

  • Athiwat Tiprasaharn (finder)
  • Waris Damkham (finder)

Website Distribution by Country

Number of websites using CVE-2026-1941
United States23 websites


Germany6 websites
Italy5 websites
Netherlands3 websites
Bulgaria2 websites
Canada2 websites
France2 websites
GB2 websites
Poland2 websites
Austria1 websites

Website Distribution by TLD

Number of websites using CVE-2026-1941
.com21 websites
.org11 websites
.de5 websites
.ca2 websites
.fr2 websites
.it2 websites
.nl2 websites
.at1 websites
.com.br1 websites
.net1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-1941

Top websites that are affected by CVE-2026-1941. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*****************.org United States***,***
*************.***.au Australia***,***
******.com Spain*,***,***
**********.com United States*,***,***
*****************.org United States*,***,***
****.**.ca Canada*,***,***
***********.com Germany*,***,***
********.org United States*,***,***
************.org United States*,***,***
****************.org United States*,***,***
See full domain list

FAQ

CVE-2026-1941 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Wp Event Aggregator
A total of 53 websites have been identified as vulnerable to CVE-2026-1941, based on global website indexing conducted by WebTechSurvey.
The Wp Event Aggregator is affected by the CVE-2026-1941 vulnerability.
Wp Event Aggregator versions up to and including 1.8.7 are vulnerable to CVE-2026-1941.

References