CVE-2026-13441 Overview
CVE-2026-13441 is a Stored Cross-Site Scripting (XSS) vulnerability in the EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress. The flaw affects all versions up to and including 4.3.4.2. The plugin fails to sanitize input and escape output on the new_event_type_background_color parameter. Authenticated attackers with custom-level access can inject arbitrary JavaScript into pages rendered to other users. When the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) is enabled, unauthenticated attackers can also submit event types through the frontend form. This vulnerability is tracked under CWE-79.
Critical Impact
Attackers can inject persistent JavaScript that executes in the browser of any user visiting an affected page, enabling session theft, administrative action hijacking, and site defacement.
Affected Products
- EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress
- All versions up to and including 4.3.4.2
- WordPress sites with the Guest Submissions setting (allow_submission_by_anonymous_user) enabled are exposed to unauthenticated exploitation
Discovery Timeline
- 2026-07-09 - CVE-2026-13441 published to NVD
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-13441
Vulnerability Analysis
The vulnerability resides in the EventPrime plugin's handling of the new_event_type_background_color parameter when creating or updating event types. The plugin accepts the value without applying sufficient input sanitization on submission and without escaping the value on output. As a result, arbitrary HTML and JavaScript payloads submitted through this parameter persist in the database and execute in the context of any user visiting a page that renders the affected event type.
Because the injected script executes in the site's origin, an attacker can perform actions on behalf of the victim, including administrators. Typical outcomes include cookie theft, forced privileged actions via authenticated requests, and content injection that facilitates phishing.
Root Cause
The root cause is missing input sanitization and missing output escaping on the new_event_type_background_color parameter, categorized as [CWE-79] Improper Neutralization of Input During Web Page Generation. The relevant code paths are documented in the plugin source in admin/class-eventprime-event-calendar-management-admin.php at line 1973, includes/class-ep-ajax.php at line 1200, and includes/class-eventprime-functions.php at line 9793. See the WordPress Code Review - Admin reference for the vulnerable code.
Attack Vector
The attack vector depends on the plugin configuration. When allow_submission_by_anonymous_user is enabled, an unauthenticated attacker submits a crafted event type through the frontend form. When the setting is disabled, exploitation requires at minimum a subscriber-level authenticated account, with custom-level or higher access needed for the administrative injection path. The stored payload executes when any user, including administrators, browses the affected page.
No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2026-13441
Indicators of Compromise
- Event type records containing HTML tags, <script> blocks, on* event handlers, or javascript: URIs in color-related fields such as new_event_type_background_color
- Unexpected outbound requests from browsers of authenticated administrators after visiting event pages
- New or modified event types created shortly after anonymous frontend submissions when Guest Submissions is enabled
Detection Strategies
- Review the WordPress wp_postmeta and EventPrime-specific tables for event type metadata containing non-color values in color fields
- Inspect web server logs for POST requests to EventPrime AJAX endpoints that include unusual payloads in the new_event_type_background_color parameter
- Correlate frontend event-type submissions from unauthenticated sources with subsequent script execution reported by browser CSP violation logs
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture inline script executions originating from injected payloads
- Alert on creation of WordPress event types by low-privilege or anonymous users when Guest Submissions is enabled
- Ingest WordPress and web server logs into a centralized analytics platform to hunt for XSS payload patterns across historical data
How to Mitigate CVE-2026-13441
Immediate Actions Required
- Update the EventPrime – Events Calendar, Bookings and Tickets plugin to a version released after 4.3.4.2 that addresses this vulnerability
- Disable the Guest Submissions setting (allow_submission_by_anonymous_user) if anonymous event submissions are not required
- Audit existing event types for HTML or script content in color-related fields and remove malicious entries
- Rotate WordPress administrator credentials and invalidate active sessions if injection is confirmed
Patch Information
The vendor changeset addressing this issue is referenced in the EventPrime ChangeSet Overview. Site administrators should apply the latest available version of the plugin through the WordPress plugin manager.
Workarounds
- Disable the EventPrime plugin until a patched version is applied if event functionality is not immediately required
- Restrict the custom-level role and above to trusted users only
- Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and JavaScript syntax in the new_event_type_background_color parameter
- Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of stored XSS execution
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
