CVE-2026-12924: WordPress Eventin Plugin XSS Vulnerability

CVE-2026-12924 Overview

CVE-2026-12924 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress. The flaw exists in all versions up to and including 4.1.15. The plugin fails to properly sanitize input and escape output for the etn_faq_content parameter. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into event pages. The payload executes in the browser of any user who views the affected page.

Critical Impact
Authenticated contributors can persist JavaScript payloads on event pages, enabling session hijacking, credential theft, and administrative account takeover when victims view injected content.

Affected Products

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress
All versions up to and including 4.1.15
WordPress sites allowing contributor-level user registration

Discovery Timeline

2026-07-10 - CVE-2026-12924 published to the National Vulnerability Database (NVD)
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-12924

Vulnerability Analysis

The vulnerability originates in the Eventin plugin's handling of FAQ content associated with event objects. The plugin accepts user-supplied data through the etn_faq_content parameter and stores it in the WordPress database. When the FAQ content is rendered on the front-end event page, the plugin fails to escape HTML entities before output. Any script tags or event handler attributes submitted by a contributor persist and execute in the DOM of every visitor.

The affected code paths reside in core/event/Api/EventController.php (lines 801 and 2027), the FAQ template files templates/event/parts/styles/event-faq/style-1.php and style-2.php, and the shared rendering logic in templates/event/parts/event-details-parts.php. The utility function at utils/functions.php:44 also participates in the vulnerable output pipeline.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on read. WordPress provides functions such as wp_kses_post() for sanitizing rich text and esc_html() or esc_attr() for context-aware escaping at output. The vulnerable versions of Eventin do not apply these functions to the etn_faq_content field, allowing raw HTML and JavaScript to reach the browser.

Attack Vector

An attacker must first obtain contributor-level credentials on the target WordPress site. The attacker submits an event containing a malicious FAQ payload through the plugin's API endpoint. When a site administrator or visitor navigates to the event page, the injected script executes with the victim's session context. Because the CVSS scope is changed, the injected code can reach resources beyond the vulnerable plugin, including administrative cookies and cross-origin content within the same browser session.

No verified proof-of-concept code is publicly available. See the Wordfence Vulnerability Analysis for additional technical detail.

Detection Methods for CVE-2026-12924

Indicators of Compromise

Event FAQ entries containing <script>, onerror=, onload=, or javascript: strings stored in the wp_postmeta or plugin-specific tables
Contributor accounts creating or editing events with unusually large FAQ content payloads
Outbound requests from administrator browser sessions to unfamiliar domains shortly after viewing an event page
WordPress audit logs showing FAQ edits from newly registered contributor accounts

Detection Strategies

Query the WordPress database for stored FAQ content matching HTML tag patterns using grep-style searches against post_content and plugin meta tables
Deploy web application firewall (WAF) rules that inspect POST parameters named etn_faq_content for script markup and event handler attributes
Monitor the plugin's REST API endpoints defined in EventController.php for anomalous request bodies

Monitoring Recommendations

Enable WordPress activity logging plugins to track contributor edits to event and FAQ content
Forward WordPress and web server logs to a centralized analytics platform for correlation of contributor activity with administrator page views
Alert on any contributor account that edits multiple events within a short time window

How to Mitigate CVE-2026-12924

Immediate Actions Required

Update the Eventin plugin to a version newer than 4.1.15 as soon as the vendor releases a patched build
Audit all existing event FAQ content for stored script payloads and remove malicious entries
Review contributor and author accounts and remove any that were not provisioned by trusted administrators
Rotate administrator session cookies and passwords if evidence of exploitation is found

Patch Information

A vendor change set is referenced in the WordPress Plugin Change Set. Site owners should apply the plugin update through the WordPress admin dashboard or via wp-cli once a fixed release is available in the WordPress plugin repository.

Workarounds

Restrict contributor-level registration and require administrator approval for new author or contributor accounts
Deploy a WAF rule that blocks HTML markup in the etn_faq_content parameter until the plugin is patched
Temporarily disable the Eventin plugin on public-facing sites that cannot restrict contributor access
Apply a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS payloads

bash

# Example wp-cli command to update the plugin once a fix is available
wp plugin update wp-event-solution --version=<patched-version>

# Example query to identify potentially malicious FAQ content
wp db query "SELECT post_id, meta_key, meta_value FROM wp_postmeta WHERE meta_key LIKE '%etn_faq%' AND meta_value REGEXP '<script|onerror=|onload=|javascript:';"