CVE-2026-60119: Hieventsdev Hi.events

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.

Affected products

Published 2026-07-14. Last modified 2026-07-15.