CVE-2026-12924
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Eventin plugin for WordPress (versions up to and including 4.1.15) is vulnerable to stored XSS via the 'etn_faq_content' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user visits an affected page.
Risk Assessment
An attacker can inject malicious scripts that hijack user sessions, steal sensitive data, or redirect to phishing sites, compromising the confidentiality and integrity of organizational data.
Recommendation
Immediately update the Eventin plugin to the latest available version (above 4.1.15). If an update is not possible, temporarily disable the plugin or restrict content editing privileges to trusted users only.
Other vulnerabilities in Eventin
See all- CVE-2026-77694Medium
The Eventin WordPress plugin before version 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order. This allows unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
- CVE-2026-13172Medium
The Eventin WordPress plugin before version 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
- CVE-2026-13176Low
The Eventin WordPress plugin before version 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
- CVE-2026-13177Medium
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
- CVE-2026-13171High
The Eventin WordPress plugin before version 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
- CVE-2026-13168Medium
The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
- CVE-2026-13178High
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status. Unauthenticated users can create orders marked as paid without completing any payment.
- CVE-2026-13039Medium
The Eventin plugin for WordPress (versions 4.0.26 to 4.1.15) has an authorization bypass vulnerability in the payment_complete() function of PaymentController.php. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, gaining paid event access, QR-code tickets, and confirmation emails without any payment.
Original NVD description (English source)
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.