Eventin <= 4.1.15 Authenticated Stored XSS via etn_faq_content (CVE-2026-12924)

Vulnerability Overview Vulnerability Name: Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) CVSS Score: 6.4 (Medium) CVE Number: CVE-2026-12924 Release Date: July 9, 2026 Last Updated: July 10, 2026 Researcher: PRISM Affected Scope Affected Software: Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) Affected Versions: <= 4.1.15 Vulnerability Description: In Eventin plugin versions 4.1.15 and earlier, insufficient input validation and output escaping for the parameter lead to a Stored Cross-Site Scripting vulnerability. Attackers can execute arbitrary JavaScript code when users visit affected pages by injecting malicious scripts. Remediation Fixed Version: 4.1.16 or later Recommended Action: Upgrade to the latest version of Eventin to patch this vulnerability. Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Related Vulnerabilities Eventin 4.0.25 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API - CVE Number: CVE-2026-13039 - CVSS Score: 5.3 - Researcher: Niv Kochan - Release Date: July 9, 2026 Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization - CVE Number: CVE-2026-68045 - CVSS Score: 5.3 - Researcher: Qlm3s - Release Date: June 15, 2026 Eventin <= 4.1.3 - Authenticated (Contributor+) PHP Object Injection - CVE Number: CVE-2026-68047 - CVSS Score: 7.5 - Researcher: w41bu1 - Release Date: January 22, 2026 Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via post_settings - CVE Number: CVE-2025-14657 - CVSS Score: 7.2 - Researcher: Sarawut Pookhet (MisterHelioz) - Release Date: January 8, 2026 Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery - CVE Number: CVE-2025-7813 - CVSS Score: 7.2 - Researcher: Gai Tanaka (53rd) - Release Date: August 22, 2025 Eventin <= 4.0.31 - Authenticated (Contributor+) PHP Object Injection - CVE Number: CVE-2025-49869 - CVSS Score: 7.5 - Researcher: Nguyen Ngoc Quang Bach (naysbachs) - Release Date: August 13, 2025 Eventin <= 4.0.24 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover - CVE Number: CVE-2025-4796 - CVSS Score: 8.8 - Researcher: István Márton - Release Date: August 8, 2025 Eventin <= 4.0.28 - Reflected Cross-Site Scripting - CVE Number: CVE-2025-49221 - CVSS Score: 6.1 - Researcher: Nguyen Ngoc Quang Bach (naysbachs) - Release Date: June 23, 2025 Summary A Stored Cross-Site Scripting vulnerability exists in the Eventin plugin versions 4.1.15 and earlier. It is recommended to upgrade to version 4.1.16 or later to patch this vulnerability. Additionally, the Eventin plugin has multiple other security vulnerabilities; regular checks and updates are advised to ensure website security.

Goal Reached Thanks to every supporter — we hit 100%!

Eventin <= 4.1.15 Authenticated Stored XSS via etn_faq_content (CVE-2026-12924)