EventON CVE-2026-81791

Exploitation requires a valid WordPress subscriber-level account (or higher) on the target site - the CVSS PR:L metric confirms this minimum authentication bar. The victim (typically an administrator) must navigate to the page rendering the injected event content (UI:R). The site must be running EventON plugin version 2.5.7 or earlier. Subscriber self-registration must be enabled on the WordPress site (Settings → General → 'Anyone can register') for an external attacker to obtain the required account without prior credential compromise. Sites that disable subscriber registration or restrict event submission to editors/admins significantly reduce exposure.

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L accurately reflects the authenticated, low-privilege attack origin and the cross-context impact on other users. The PR:L metric confirms a subscriber-level WordPress account is required - this is not unauthenticated. The UI:R metric means a privileged user (e.g., admin) must navigate to the page rendering the injected payload. In practice, stored XSS on a WordPress event plugin represents a meaningful risk: attackers who can register as subscribers can plant persistent payloads that fire against admins, potentially leading to administrative account takeover or site-level compromise. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread exploitation. The A:L metric in the supplied CVSS vector is atypical for XSS and likely reflects the secondary availability impact of admin session hijacking rather than direct denial-of-service; real-world direct availability impact is minimal.

An attacker registers a free subscriber account on a WordPress site running EventON ≤ 2.5.7, then submits or edits an event entry with a crafted XSS payload embedded in an insufficiently sanitized field. When an administrator later views the event listing or management page, the stored script executes in their browser, allowing the attacker to steal the admin session cookie, forge authenticated requests, or create a rogue admin account.