CVE-2026-42686
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
There is a Cross Site Scripting (XSS) vulnerability affecting subscribers in EventPrime versions <= 4.3.2.1.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to upgrade to the latest version of EventPrime to mitigate this vulnerability.
Other vulnerabilities in EventPrime
See all- CVE-2026-42687High
There is a vulnerability in EventPrime versions up to 4.3.2.1 that allows unauthenticated PHP object injection.
- CVE-2026-39518High
Versions of EventPrime <= 4.3.0.0 have a vulnerability related to Insecure Direct Object References (IDOR). This allows subscribers to access data they should not have permission to.
- CVE-2026-42669High
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.