CVE-2026-12924: Stored XSS in Eventin WordPress Plugin (Versions ≤4.1.15)

Technical summary

CVE-2026-12924 is a Stored XSS vulnerability (CWE-79) in the Eventin plugin stemming from inadequate input sanitization and output escaping of the 'etn_faq_content' parameter. The flaw allows authenticated users with contributor-level or higher privileges to persist arbitrary JavaScript within the WordPress database. When any visitor accesses a page containing the injected FAQ content, the malicious script executes in their browser context with the privileges of the logged-in user. The vulnerability has a CVSS v3.1 score of 6.4 (MEDIUM severity) with a network attack vector, low complexity, and requires low privileges but no user interaction for execution.

Business impact

Organizations using Eventin to manage events and registrations face potential compromise of user data and trust. Attackers with contributor access (common in multi-author or managed hosting scenarios) can silently inject malicious scripts that target event attendees, collecting credentials or spreading further compromise. For high-traffic event sites, this could affect hundreds or thousands of users per injection. Reputational damage occurs when visitors encounter defacement or security warnings. The risk is amplified if event registrations collect sensitive information like payment details or personal identification.

Affected systems

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin in all versions up to and including 4.1.15 is affected. This includes any WordPress installation running this plugin with that version number or earlier. The vulnerability requires an authenticated attacker with at least contributor-level access, limiting the immediate attack surface to internal users or compromised accounts with that privilege level or higher.

Exploitability

Exploitation requires existing authenticated access with contributor permissions or above—not trivial for external attackers but realistic for disgruntled employees, compromised accounts, or scenarios where contributor roles are broadly assigned. The attack requires no user interaction from the victim and no social engineering; the XSS payload executes automatically when the FAQ page loads. No special tools or techniques are needed beyond basic JavaScript knowledge, making this a low-barrier attack once access is obtained. The lack of KEV status indicates this has not yet been observed in active exploitation campaigns, but the straightforward nature of the flaw means weaponization is trivial.

Remediation

Update the Eventin plugin to a patched version released after 4.1.15. Verify the availability of a security update from the plugin authors and apply it immediately after testing in a non-production environment. Simultaneously, audit your WordPress user base to identify and review accounts with contributor permissions or higher, particularly those inactive or suspicious. If an update is unavailable or delayed, consider temporarily disabling the FAQ feature or restricting access to the events admin interface via IP whitelisting or Web Application Firewall rules targeting the FAQ content parameter.

Patch guidance

Check the official Eventin plugin repository or the vendor's security advisories for a patched release version. Apply the update through WordPress's built-in plugin update mechanism once available. Before deploying to production, test on a staging environment to ensure compatibility with your event calendar setup and any custom integrations. If you are running a version prior to 4.1.15, prioritize this update within your normal patch cycle. Document the patching date and verify successful installation by confirming the plugin version in WordPress admin settings.

Detection guidance

Monitor database logs and file integrity tools for unauthorized changes to the wp_postmeta and wp_posts tables where FAQ content is stored, particularly the 'etn_faq_content' field. Search your database for HTML/JavaScript patterns (script tags, event handlers like onclick, onerror) within FAQ content added after the last trusted backup. Review WordPress audit logs for FAQ or event creation/modification by unexpected users. Implement Content Security Policy (CSP) headers to restrict inline script execution, which will block many stored XSS payloads from running even if injected. Check web server access logs for unusual patterns correlating with FAQ page requests.

Why prioritize this

Although CVSS 6.4 (MEDIUM) appears modest, stored XSS in a widely-used plugin affecting all visitors to a page merits urgent attention. The need for prior authentication lowers the score but does not eliminate business risk—many organizations have multiple contributor accounts. The lack of user interaction needed for exploitation and the high likelihood of compromised accounts in the contributor tier make this a realistic, high-impact threat. Prioritize this above many higher-scored vulnerabilities that require external user interaction or zero-day exploitation skills.

Risk score, explained

The CVSS 6.4 score reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), requirement for low-level authentication (PR:L), no user interaction needed (UI:N), and changed scope (S:C). The score does not fully capture the reputational and data-loss risks to event-driven businesses or the ease of lateral escalation if an attacker gains contributor access. Organizations handling sensitive event data (conferences, paid workshops, fundraisers) should treat this as higher priority than the base CVSS suggests.

Frequently asked questions