CVE-2026-15402: Eventin WordPress Plugin XSS Vulnerability

CVE-2026-15402 Overview

CVE-2026-15402 is a Stored Cross-Site Scripting (XSS) vulnerability in the Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress. The flaw affects all plugin versions up to and including 4.1.23. It resides in the handling of the etn_shedule_objective schedule_slot parameter, which lacks sufficient input sanitization and output escaping [CWE-79].

Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected payload executes in the browser of any user who accesses the affected page, enabling session hijacking, credential theft, or redirection.

Critical Impact
Contributor-level accounts can persistently inject JavaScript that executes against site visitors and administrators, exposing sessions, cookies, and privileged actions.

Affected Products

Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin, versions ≤ 4.1.23
Any WordPress site allowing contributor-level (or higher) registration on affected versions
Multisite WordPress deployments with the plugin network-enabled

Discovery Timeline

2026-09-15 - CVE-2026-15402 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-15402

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Eventin plugin's schedule management functionality. The etn_shedule_objective field within the schedule_slot parameter accepts user-supplied input through the plugin's schedule REST API endpoints. That input is written to the database and later rendered in the schedule list template without adequate sanitization or output escaping.

Because the payload persists in the database, every authenticated or unauthenticated visitor who views the affected event page triggers execution of the attacker-controlled script. The attacker context is a WordPress contributor, which is a low-privilege role available on many sites that accept guest authors or event submitters.

Root Cause

The underlying issue is missing sanitization on write and missing escaping on read. The schedule controller processes schedule_slot data supplied to the plugin's REST routes without stripping HTML or JavaScript from the etn_shedule_objective sub-field. The schedule-list.php template then outputs the stored value into the DOM without applying WordPress escaping helpers such as esc_html() or wp_kses_post(). See the WordPress Plugin Schedule API Code and the WordPress Plugin Schedule List Template for the vulnerable code paths.

Attack Vector

An authenticated attacker with contributor privileges submits a crafted schedule slot containing a JavaScript payload in the etn_shedule_objective field via the plugin's schedule endpoints. The payload is stored in post metadata. When any user renders an event page containing that schedule, the script executes in their browser under the origin of the WordPress site. Exploitation requires no user interaction beyond loading the page. Further technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-15402

Indicators of Compromise

Schedule slot entries containing <script>, onerror=, onload=, or javascript: strings in post meta associated with Eventin events
Unexpected outbound requests from visitor browsers to attacker-controlled domains when viewing event pages
New or modified administrator accounts following contributor account activity on the plugin's schedule endpoints
WordPress audit log entries showing contributor-role users invoking POST requests against /wp-json/eventin/v1/schedules or similar schedule routes

Detection Strategies

Query the wp_postmeta table for schedule payloads containing HTML tags or JavaScript event handlers in the etn_shedule_objective field
Enable a web application firewall (WAF) rule set that inspects REST API bodies for XSS payloads targeting Eventin endpoints
Review web server logs for anomalous POST volume from contributor sessions to schedule controller routes

Monitoring Recommendations

Alert on browser-side Content Security Policy (CSP) violations reported by administrators or logged-in editors visiting event pages
Monitor creation of new WordPress users and role changes correlated with recent contributor activity
Track plugin version inventory to ensure Eventin installations are upgraded past 4.1.23

How to Mitigate CVE-2026-15402

Immediate Actions Required

Update the Eventin plugin to a patched release above 4.1.23 as soon as it is available from the vendor
Audit all contributor and higher-role accounts and remove unused or untrusted users
Inspect existing schedule entries for stored payloads and purge malicious content from post meta
Rotate administrator credentials and invalidate active WordPress sessions if suspicious activity is identified

Patch Information

Refer to the vendor changeset at WordPress Plugin Changeset and the Wordfence Vulnerability Report for fix details. Apply the update through the WordPress plugin manager or by replacing plugin files with the patched version supplied by the vendor.

Workarounds

Temporarily deactivate the Eventin plugin on sites that cannot be patched immediately
Restrict contributor registration and require administrator approval before granting the role
Deploy a WAF rule to block requests to Eventin schedule endpoints containing <, >, or javascript: in the etn_shedule_objective parameter
Enforce a strict Content Security Policy that disallows inline scripts on event pages

bash

# Configuration example: block XSS payloads to Eventin schedule endpoint via ModSecurity
SecRule REQUEST_URI "@contains /wp-json/eventin" \
    "id:1015402,phase:2,deny,status:403,\
    msg:'Blocked potential XSS in Eventin schedule_slot',\
    chain"
    SecRule ARGS:etn_shedule_objective "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni"