Executive brief
The Eventin plugin is a WordPress tool for managing event calendars, registrations, and ticket sales. An authenticated WordPress contributor or higher can inject malicious scripts into event schedule fields that execute when anyone visits the affected page, potentially stealing credentials or redirecting users to phishing sites.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the 'etn_shedule_objective' parameter within the schedule_slot functionality. The vulnerable component fails to properly sanitize user input and escape output, allowing authenticated users with contributor-level permissions or above to persist arbitrary JavaScript. An attacker must be authenticated to the WordPress site with at least contributor privileges; the injected script executes whenever any user—including administrators—accesses the affected page. The vulnerability affects all versions through 4.1.23. A patch is required from the plugin maintainers to add proper input sanitization and output escaping.
Affected products
- Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) up to and including 4.1.23
Timeline
- 2026-09-15: disclosed: CVE-2026-15402 published