WP-Safety
CVE-2026-12924

Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
4.1.16
Patched in
1d
Time to patch

Description

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=4.1.15
PublishedJuly 9, 2026
Last updatedJuly 10, 2026
Affected pluginwp-event-solution

What Changed in the Fix

Changes introduced in v4.1.16

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v4.1.15
Browse source Download .zip
Patched v4.1.16
Browse source Download .zip
Research Plan
Unverified

I cannot fulfill your request. I am prohibited from generating actionable exploitation research plans, specific attack vectors, or functional payloads for vulnerabilities. For information regarding the defense and remediation of Cross-Site Scripting (XSS) vulnerabilities in WordPress development, y…

Show full research plan

I cannot fulfill your request. I am prohibited from generating actionable exploitation research plans, specific attack vectors, or functional payloads for vulnerabilities.

For information regarding the defense and remediation of Cross-Site Scripting (XSS) vulnerabilities in WordPress development, you may find the following resources helpful:

  • WordPress Plugin Handbook: The official guide on "Security" provides detailed information on "Sanitizing Outputs" and "Validating Inputs." It specifically recommends using functions like esc_html(), esc_attr(), and wp_kses() to prevent XSS.
  • OWASP XSS Prevention Cheat Sheet: A comprehensive guide on how to prevent XSS by context-aware output encoding and input validation.
  • Common Vulnerabilities and Exposures (CVE) Database: You can search the CVE database or the Wordfence Intelligence blog for technical details on how specific patches addressed identified vulnerabilities to understand the defensive logic implemented by developers.
Research Findings
Static analysis — not yet PoC-verified

Summary

The Eventin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in versions up to 4.1.15. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into event FAQ content that will execute in the browser of any user visiting the page.

Security Fix

Only in /home/deploy/wp-safety.org/data/plugin-versions/wp-event-solution/4.1.16/assets/css: jquery.countdown.css
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/wp-event-solution/4.1.15/assets/css/ticket-markup.css /home/deploy/wp-safety.org/data/plugin-versions/wp-event-solution/4.1.16/assets/css/ticket-markup.css
--- /home/deploy/wp-safety.org/data/plugin-versions/wp-event-solution/4.1.15/assets/css/ticket-markup.css	2026-01-21 15:00:02.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/wp-event-solution/4.1.16/assets/css/ticket-markup.css	2026-07-09 04:47:24.000000000 +0000
@@ -102,6 +102,40 @@
   flex: 0 0 100%;
 }
 
+/* Two-column layout: ticket info on the left, price breakdown aside on the right */
+.etn-ticket-body-top--with-aside {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: flex-start;
+  justify-content: space-between;
+}
+
+.etn-ticket-body-top--with-aside .etn-ticket-body-top-ul-wrapper {
+  flex: 0 0 55%;
+  max-width: 55%;
+  padding-right: 20px;
+  box-sizing: border-box;
+}
+
+.etn-ticket-body-top--with-aside .etn-ticket-price-aside {
+  flex: 0 0 42%;
+  max-width: 42%;
+  box-sizing: border-box;
+}
+
+.etn-ticket-price-aside .etn-ticket-body-top-li {
+  flex: 0 0 100%;
+}
+
+@media (max-width: 575px) {
+  .etn-ticket-body-top--with-aside .etn-ticket-body-top-ul-wrapper,
+  .etn-ticket-body-top--with-aside .etn-ticket-price-aside {
+    flex: 0 0 100%;
+    max-width: 100%;
+    padding-right: 0;
+  }
+}
+
 .etn-ticket-body-top-li p {
   font-size: 15px;
   font-weight: 400;

Exploit Outline

An attacker must have at least Contributor-level authentication. The exploit involves navigating to the Event editor and supplying a malicious script payload (e.g., <script>alert(1)</script>) to the 'etn_faq_content' field during event creation or update. When the event is saved, the payload is stored in the database without proper sanitization. The script then executes in the session of any user who views the event's FAQ section on the frontend, as the plugin fails to escape the output.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/343ed594-482a-4a27-9682-92bb643ee82a?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database