# CVE-2026-42686: EventPrime Cross Site Scripting in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-42686-eventprime-cross-site-scripting-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-42686 · Severity: high · CVSS 7.1 · Published 2026-06-15

EventPrime is a WordPress plugin used for managing event calendars and bookings. A security flaw allows users with basic 'Subscriber' accounts to inject malicious scripts into the website. This could lead to unauthorized redirects, the display of fraudulent advertisements, or the disruption of site operations for other visitors.

Technologies: [EventPrime](https://junglewise.ai/threats/technologies/eventprime). Vendors: [EventPrime](https://junglewise.ai/threats/vendors/eventprime).

## Quick answers

**Is CVE-2026-42686 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42686 being exploited in the wild.

**How severe is CVE-2026-42686?** High severity, with a CVSS score of 7.1, published 15 June 2026.

**Which products and versions are affected?** EventPrime <= 4.3.2.1.

**Is there a fix for CVE-2026-42686?** A patch was published on 2026-05-24: Version 4.3.2.2 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42686 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42686?** Check whether you run EventPrime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the EventPrime plugin for WordPress (versions 4.3.2.1 and below) due to improper neutralization of input during web page generation (CWE-79). The vulnerability requires Subscriber-level authentication to exploit. An attacker can inject malicious HTML or JavaScript payloads that execute in the context of other users' browsers. While the CVSS vector indicates a high impact on availability, the primary risk involves the injection of redirects or unauthorized content. The issue is resolved in version 4.3.2.2.

## Affected products

- EventPrime EventPrime <= 4.3.2.1

## Timeline

- 2026-04-24: other: Reported by researcher hhhai
- 2026-05-24: advisory: Initial advisory published by Patchstack
- 2026-06-15: disclosed: CVE published to NVD
- 2026-05-24: patched: Version 4.3.2.2 released to address the vulnerability

## References

- [https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/eventprime-event-calendar-management/vulnerability/wordpress-eventprime-plugin-4-3-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [EventPrime PHP object injection in Subscriber role](https://junglewise.ai/threats/cve-2026-56053-eventprime-php-object-injection-in-subscriber-role)
- [EventPrime PHP Object Injection in Event Calendar Management](https://junglewise.ai/threats/cve-2026-42687-eventprime-php-object-injection-in-event-calendar-management)
- [EventPrime IDOR in WordPress plugin allows Subscriber data access](https://junglewise.ai/threats/cve-2026-39518-eventprime-idor-in-wordpress-plugin-allows-subscriber-data-access)
- [EventPrime Missing Authorization in Access Control Security Levels](https://junglewise.ai/threats/cve-2026-42669-eventprime-missing-authorization-in-access-control-security)