Is CVE-2026-15402 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15402 being exploited in the wild.

How severe is CVE-2026-15402?

Medium severity, with a CVSS score of 6.4, published 15 September 2026.

Which products and versions are affected?

Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) up to and including 4.1.23.

Is there a fix for CVE-2026-15402?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15402 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15402?

Check whether you run Eventin Event Calendar, Event Registration or Tickets & Booking (AI Powered) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15402: Eventin Event Calendar stored XSS in schedule_slot parameter

CVE-2026-15402 · Severity: medium · CVSS 6.4 · Published 2026-09-15

The Eventin plugin is a WordPress tool for managing event calendars, registrations, and ticket sales. An authenticated WordPress contributor or higher can inject malicious scripts into event schedule fields that execute when anyone visits the affected page, potentially stealing credentials or redirecting users to phishing sites.

Vendors: Eventin.

Quick answers

Is CVE-2026-15402 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15402 being exploited in the wild.
How severe is CVE-2026-15402?: Medium severity, with a CVSS score of 6.4, published 15 September 2026.
Which products and versions are affected?: Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) up to and including 4.1.23.
Is there a fix for CVE-2026-15402?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15402 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15402?: Check whether you run Eventin Event Calendar, Event Registration or Tickets & Booking (AI Powered) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the 'etn_shedule_objective' parameter within the schedule_slot functionality. The vulnerable component fails to properly sanitize user input and escape output, allowing authenticated users with contributor-level permissions or above to persist arbitrary JavaScript. An attacker must be authenticated to the WordPress site with at least contributor privileges; the injected script executes whenever any user—including administrators—accesses the affected page. The vulnerability affects all versions through 4.1.23. A patch is required from the plugin maintainers to add proper input sanitization and output escaping.

Affected products

Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) up to and including 4.1.23

Timeline

2026-09-15: disclosed: CVE-2026-15402 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.