Events Manager 7.4.3 is out now and we recommend updating today. It fixes the vulnerability
reported as CVE-2026-66457, and carries a handful of bug fixes reported through our support forums.

It is reflected XSS, not stored, and the difference matters more than it might sound. This release
also clears up some confusion around 7.4.2, and we would rather explain it than leave it sitting there.

Reflected, not stored

Some trackers that relayed Patchstack’s report list this as stored XSS. It is reflected, and if you
have been trying to work out your exposure that distinction is the whole question.

A stored issue means something malicious is already sitting in your database, running for anyone who
loads the page. A reflected one never touches your site’s data. It only fires for someone who follows
a crafted link, and it does nothing until they do. Sites listed as carrying a stored vulnerability
went looking for planted payloads that were never going to be there.

What we thought, and what it actually was

The report surfaced shortly after 7.4.1, which carried a batch of significant security fixes. Looking
for it, we found an unfiltered variable that looked like it belonged to the same family, and it seemed
reasonable that the report had come out of a rescan following that release.

So we fixed what we found in 7.4.2, and attached a “possibly” to the changelog because we could not
confirm it.

• Fixed in 7.4.2, self-diagnosed: an unfiltered variable found in our own review. Real, and worth
  fixing. Not the reported one.
• Fixed in 7.4.3, CVE-2026-66457: reflected XSS via list formatting parameters. The reported
  vulnerability, in a different part of the code. Still live on 7.4.2.

It turned out to be a different issue in a different part of the code, so 7.4.2 did not fix what
people believed it fixed. If you are running it, please update.

A recipe for confusion

Over the past few months we have patched close to forty security vulnerabilities across the Events
Manager family. Most we identified ourselves through the internal review programme we wrote about in July rather than having them reported to us, and a number of those were then reported by researchers after we had already shipped the fix.

Those fixes do not update uniformly across the vulnerability databases. Issues we resolved some time ago are still listed as open in one channel and patched in another, and the versions each one names do not always agree.

Two of those earlier updates included reflected XSS fixes of their own. By the time this report appeared there were already several similar-sounding entries in circulation, at different stages of being marked fixed, naming different versions.

Add a notification that never reached us, and it was a recipe for confusion. We do not blame anyone
for being unsure whether they were exposed, or on which version.

Why this took us longer than usual

That notification normally gives us the details and a window to patch before anything is published. Without it, the report went public while we were still in the dark about what it described, which left us knowing a vulnerability existed in our plugin without being able to see what it was.

So we approached Patchstack directly and asked. They worked with us to give us access to the report,
and we are grateful for that. Once we had it in hand we reproduced the issue, confirmed it was live on
7.4.2, wrote the fix and tested it.

7.4.3 changelog

• Security: Fixed an XSS vulnerability CVE-2026-66457. Reported by Mukhlis Amien via Patchstack.
• Security: Fixed low-severity (self-diagnosed) vulnerability allowing unfiltered shortcode output
  under specific setup/variable circumstances.
• Fixed: fatal error when the booking cancellation cut-off is set as an interval such as P2D rather
  than a number of hours
• Fixed: fatal error saving a location with an attribute no longer in your configured attribute list
• Fixed: quotes in a custom calendar month format broke the month picker
• Tweaked: documentation links now use https

With thanks to Patchstack for working with us to get us the detail we needed.

If you run Events Manager, the most useful thing you can do today is update. Thank you for trusting us
with your events, your attendees and their data.