EUVD-2026-42843
GHSA-j2h9-v293-4vf9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network-delivered stored XSS (AV:N/AC:L) requires contributor-level WordPress account (PR:L); payload executes cross-context in victims' browsers (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Eventin - Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the Eventin WordPress event management plugin (all versions through 4.1.15) lets any contributor-level user permanently embed malicious JavaScript in event FAQ sections via the unescaped etn_faq_content parameter. The CVSS scope change (S:C) confirms the impact crosses the attacker's security context - injected scripts execute in any visitor's browser who loads the affected event page, enabling session hijacking or credential harvesting of higher-privileged users including site administrators. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity and commonly granted contributor role make this a credible insider-threat risk on multi-user WordPress installations.
Technical ContextAI
The vulnerability resides in the Eventin plugin (vendor: Arraytics; CPE: cpe:2.3:a:arraytics:eventin_-_event_calendar,_event_registration,_tickets_&_booking_(ai_powered):*:*:*:*:*:*:*:*), a WordPress plugin for event management, ticketing, and registration. The affected code path spans the event FAQ subsystem: EventController.php (lines 801 and 2027) handles API-level storage of the etn_faq_content parameter without adequate sanitization, while rendering occurs in event-details-parts.php (line 359) and two FAQ style templates (event-faq/style-1.php:27, event-faq/style-2.php:26) without output escaping. The utils/functions.php:44 utility layer was also flagged by Wordfence, suggesting the sanitization gap exists at a shared helper level rather than being isolated to a single template. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: untrusted data from the etn_faq_content field flows into HTML output without encoding, allowing persistent script injection that survives page reloads.
RemediationAI
Upstream fix available via WordPress SVN changeset revision 3600977 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3600977%40wp-event-solution&new=3600977%40wp-event-solution); however, the exact patched release version number is not confirmed from the available data - update to the latest version in the WordPress plugin directory and verify the installed version exceeds 4.1.15. If an immediate update is not feasible, restrict the WordPress Contributor role to only highly-trusted internal users to eliminate the required access vector, accepting the trade-off of reduced editorial workflow flexibility for external contributors. As a secondary compensating control, a WAF rule blocking script injection patterns (angle brackets, script keywords, JavaScript URIs) in POST parameters to Eventin's event API endpoints can reduce exploitation risk while a patch is staged, though WAF bypass techniques exist and this should not substitute for patching.
Authorization bypass in the Eventin WordPress plugin (versions 4.0.26-4.1.15) enables unauthenticated attackers to mark
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user cap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today