What is the CVSS score of CVE-2026-13441?

CVE-2026-13441 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of EventPrime are affected by CVE-2026-13441?

The EventPrime events plugin for WordPress (versions through 4.3.4.2) contains a stored cross-site scripting vulnerability that enables attackers to inject malicious code into event pages,…

How to fix or mitigate CVE-2026-13441?

Within 24 hours: Audit all WordPress installations for EventPrime plugin version 4.3.4.2 or earlier and inspect event-type configurations for suspicious entries in the 'new_event_type_background_color' field. Within 7 days: Implement interim controls-restrict event-type creation permissions to administrators only, enforce strict input validation on color fields, or disable the plugin entirely if not business-critical. Within 30 days: Contact Metagauss for patch availability; if no remediation is released, migrate to an alternative event management plugin or remove EventPrime from production.

EventPrime CVE-2026-13441

EUVD-2026-42559 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 Wordfence

GHSA-566f-2h7m-xrh3

WordPress XSS Wordpress Plugin Eventprime Events Calendar Bookings And Tickets Metagauss

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

Default configuration needs a subscriber-level account (PR:L), stored payload runs without victim interaction (UI:N) and crosses into another security context (S:C); XSS yields Low C/I and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 11:32 vuln.today

CVE Published

Jul 09, 2026 - 09:31 nvd

HIGH 7.2

DescriptionCVE.org

The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to be enabled, which allows unauthenticated attackers to submit event types via the frontend form; when that setting is disabled, exploitation requires at minimum a subscriber-level authenticated account.

AnalysisAI

Stored cross-site scripting in the EventPrime events plugin for WordPress (versions through 4.3.4.2, by Metagauss) lets low-privileged or, in one configuration, unauthenticated actors persist arbitrary JavaScript through the 'new_event_type_background_color' field of the event-type creation flow. The injected script runs in the browser of any user who later views the affected page, enabling session/context theft in the WordPress front end and admin context. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; the finding was reported by Wordfence.

Technical ContextAI

The affected component is EventPrime (CPE cpe:2.3:a:metagauss:eventprime_-_events_calendar,_bookings_and_tickets), a WordPress calendar/booking/ticketing plugin. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the 'new_event_type_background_color' parameter, handled through the plugin's AJAX event-type creation path (class-ep-ajax.php around line 1200 and the admin/functions rendering at class-eventprime-event-calendar-management-admin.php:1973 and class-eventprime-functions.php:9793 per the WordPress plugin trac references), is neither sanitized on input nor escaped on output. A value expected to be a color string is instead stored verbatim and later reflected into rendered pages, so a crafted payload breaks out of the intended attribute/style context and executes as script. Because event types are shared taxonomy-style data, the payload persists and affects multiple viewers.

RemediationAI

No vendor-released patch version is identified in the provided data (all versions through 4.3.4.2 are vulnerable and no fixed release number is stated), so the primary action is to update EventPrime to the latest available release above 4.3.4.2 as published on the WordPress plugin repository and to consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2abd400b-c633-4b38-ad3e-c9ce602ff07f?source=cve) for the confirmed fixed version. As the most effective compensating control until patched, disable the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to remove the unauthenticated attack path - trade-off: legitimate anonymous users can no longer submit events via the front-end form. Additionally, restrict which roles hold custom/event-creation capabilities so untrusted subscriber accounts cannot create event types, and deploy a WAF rule (e.g., Wordfence) to filter script payloads in the event-type creation AJAX request; the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3595157%40eventprime-event-calendar-management&new=3595157%40eventprime-event-calendar-management documents the code path to monitor.