Eventer CVE-2026-27394

Exploitation requires a victim to click or load an attacker-crafted URL (UI:R in the CVSS vector), so success depends on social-engineering the user rather than purely remote action; this is the primary limiting factor. The flaw is unauthenticated (PR:N), so no attacker credentials are needed, and it affects Eventer plugin versions <= 0.1.1 on WordPress. The exact vulnerable parameter, endpoint, or feature that reflects the payload is not described in the available sources. Impact is bounded to the victim's browser session (low confidentiality/integrity impact), not direct server compromise.

This is a moderate-severity reflected XSS (CWE-79) in the Eventer WordPress plugin, scored CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L - network-reachable, low complexity, no privileges, but requiring user interaction (UI:R) and yielding only low-magnitude confidentiality/integrity/availability impact with a changed scope. The vuln.today decision label is 'this_week', indicating a near-term but non-emergency priority. No CISA KEV listing, no EPSS score, and no PoC/exploit reference are present in the input, so there is no public signal of active exploitation or available weaponized code. The reliance on UI:R (the victim must be lured into clicking a crafted link) and the low impact ratings temper the raw 7.1 score: this is a genuine but second-tier issue rather than a mass-exploitation emergency, consistent with the 'this_week' label. EPSS and KEV data are simply absent here (not low), so widespread-versus-targeted exploitation cannot be judged from the provided signals. Note the input Description labels this 'Unauthenticated Cross Site Scripting' while the vendor reference title specifies 'reflected' XSS - treated here as reflected.

An unauthenticated attacker crafts a URL containing a malicious script payload targeting the vulnerable Eventer parameter and distributes it (e.g., via email or a malicious page) to a user of the affected WordPress site. When the victim clicks the link, the payload is reflected into the response and executes in the victim's browser session, allowing session-related data theft or actions in the site's context. No public exploit identified at time of analysis.