EUVD-2026-78297
GHSA-mcqc-q4hw-vwgg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain or register contributor-level WordPress credentials
-
DeliverySubmit crafted REST API request with XSS payload in schedule_slot etn_shedule_objective field
-
ExploitPayload stored in database without sanitization
-
ExecutionVictim (admin or other user) loads event schedule page
-
PersistInjected script executes in victim browser
-
ImpactExfiltrate session token or perform privileged actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress user account with contributor-level access or higher on the target installation - unauthenticated exploitation is not possible per the CVSS PR:L metric. The Eventin plugin must be installed, active, and at version 4.1.23 or below. The attacker must be able to create or modify event schedule entries through the plugin's REST API, which is gated by the contributor role (Permission.php L297). Final payload execution requires a second victim - ideally an administrator - to visit the page containing the injected schedule content. Sites where contributor registration is closed or restricted to trusted internal staff face substantially lower practical risk; sites that allow open public registration for event organizers at contributor level are most exposed. |
| Impact | The official CVSS 6.4 score (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) captures the medium severity accurately for most environments. The PR:L requirement is a meaningful exploitation barrier: a fully unauthenticated attacker cannot exploit this vulnerability directly, and sites that do not permit open contributor-level registration are substantially less exposed. The S:C designation reflects the cross-user impact correctly - if an administrator views the injected schedule, a session-cookie theft could cascade into full site compromise. The UI:N metric is worth scrutiny: stored XSS technically requires a victim to visit the injected page, making UI:R arguably more accurate for the end-to-end chain, though from the attacker's perspective no interaction is required after the payload is stored. No EPSS score was provided in the input data, limiting quantitative exploitation probability assessment. The vulnerability is not in CISA KEV, and no public exploit code has been identified, making widespread automated exploitation unlikely in the near term. Even a mid-sized municipal IT team in walbrzych maintaining a public-facing event registration portal on WordPress should treat this as a medium-priority patch item given the realistic risk of contributor accounts being held by external event organizers. The absence of a confirmed patched version number in available data slightly complicates remediation prioritization. |
| Exploit ScenarioDerived | An attacker who has registered or compromised a contributor-level account on a WordPress site running Eventin submits an event schedule via the plugin's REST API, embedding a JavaScript payload (e.g., a cookie-exfiltration script) in the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the etn_shedule_objective field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Update the Eventin plugin to the first version above 4.1.23; verify the latest available release in the WordPress plugin directory (wordpress.org/plugins/wp-event-solution) or consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a07070b6-37d2-4ccf-ae81-a08ac7b76241 - an exact confirmed patched version number is not independently available in the current data, so verify before upgrading. As an immediate compensating control, restrict the WordPress contributor role to verified, trusted users only, or temporarily revoke the ability for contributors to create or edit event schedules until the patch is applied; this eliminates the PR:L attack surface without requiring downtime. A WAF rule targeting unsanitized input to the etn_shedule_objective parameter in REST API calls can block exploitation at the network layer, though this should not substitute for patching as bypass techniques for WAF-based XSS filtering are well-documented.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Eventin (plugin slug: wp-event-solution) is a WordPress event management plugin by Arraytics, covering event calendars, ticketing, registration, and WooCommerce integration (CPE: cpe:2.3:a:arraytics:eventin_-_event_calendar,_tickets,_registration,_booking_&_woocommerce). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the etn_shedule_objective field within the schedule REST API endpoint is neither sanitized on write nor escaped on output. Source references pinpoint the vulnerable code paths across ScheduleController.php (L253 and L516), the rendering template schedule-list.php (L115), and supporting utilities helper.php (L78), functions.php (L47), and post-model.php (L202). The Permission.php (L297) reference suggests that contributor-role gating is present but insufficient to prevent malicious input from being persisted. Because the payload is stored in the database and echoed into page output unescaped, the scope change (S:C in the CVSS vector) is justified - the injected script executes in a browser context belonging to a different user than the attacker.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim to visit the injected page (UI:R corrects official UI:N); PR:L reflects mandatory contributor authentication; S:C and C:L/I:L are standard for cross-user XSS.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Eventin - Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB