What is the CVSS score of CVE-2026-42686?

CVE-2026-42686 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.4%.

Which versions of EventPrime are affected by CVE-2026-42686?

EventPrime WordPress plugin (versions ≤4.3.2.1) allows low-privilege site users to inject malicious code that executes in other users' browsers, enabling account compromise and administrator access…

How to fix or mitigate CVE-2026-42686?

24 hours: Identify all WordPress instances running EventPrime ≤4.3.2.1 and inventory whether Subscriber-level accounts exist on affected sites. 7 days: Implement interim mitigations-restrict Subscriber role capabilities, disable the plugin if non-critical, and enable Content Security Policy headers; configure audit logging for user submissions. 30 days: Monitor Patchstack and EventPrime vendor advisories for patch availability; prepare deployment of EventPrime 4.3.2.2 or later when released.

EventPrime CVE-2026-42686

EUVD-2026-36834 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-jpgx-m7fc-62c2

XSS Eventprime

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

5.4 MEDIUM

Network-reachable XSS exploitable by a Subscriber (PR:L) requires a victim to load the page (UI:R), executes in the victim's origin (S:C), and yields session/data exposure (C:L/I:L) with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:56 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.

AnalysisAI

Stored or reflected cross-site scripting in the EventPrime WordPress plugin (versions <= 4.3.2.1) allows authenticated users with Subscriber-level privileges to inject malicious JavaScript that executes in other users' browsers. The flaw was disclosed by Patchstack and currently has no public exploit identified at time of analysis, but the low privilege bar makes it attractive for opportunistic attackers on multi-user WordPress sites. No CISA KEV listing or EPSS data was supplied with this report.

Technical ContextAI

EventPrime is an event calendar and booking management plugin for WordPress (CPE cpe:2.3:a:eventprime:eventprime). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is rendered into HTML output without adequate output encoding or input sanitization. In the WordPress ecosystem, Subscriber-tier accounts are the lowest authenticated role and are often available via open self-registration, which significantly broadens the realistic attacker pool compared to admin- or editor-gated XSS.

RemediationAI

Upstream fix available per the Patchstack advisory; a specific released patched version was not included in the provided data, so administrators should upgrade EventPrime to the latest version published on the WordPress.org plugin repository above 4.3.2.1 and verify the installed version after update. Reference the advisory at https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-2-1-cross-site-scripting-xss-vulnerability for the exact fixed release. Until the plugin is updated, disable open user self-registration in WordPress (Settings → General → 'Anyone can register'), which removes the easiest path to obtaining a Subscriber account but breaks any legitimate self-signup flow; alternatively place a WAF rule (e.g., Wordfence, Patchstack mitigation, or Cloudflare managed XSS ruleset) in front of EventPrime endpoints to filter common XSS payloads, accepting that WAF signatures rarely catch all encoding variants. Audit existing Subscriber accounts and recently created posts/event submissions for suspicious script content before re-enabling registration.