CVE-2026-15402 in Eventin Plugin
Summary
by MITRE • 09/15/2026
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The Eventin plugin for WordPress, which provides event calendar, registration, ticketing, and booking functionalities powered by artificial intelligence, contains a significant security flaw affecting all versions up to 4.1.23. This vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue located within the etn_schedule_objective schedule_slot parameter. The root cause of this weakness lies in insufficient input sanitization and output escaping mechanisms during the processing of user-supplied data. When an attacker submits malicious script code through this specific parameter, the application fails to properly validate or encode the input before storing it in the database. Consequently, when other users subsequently view pages containing this stored payload, the browser executes the injected scripts as if they were legitimate content from the trusted site.
This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into event schedules and related displays. The impact is severe because Stored XSS payloads persist on the server side, meaning every user who views the affected page becomes a potential victim without needing any direct interaction beyond viewing the compromised content. Attackers can exploit this to steal session cookies, hijack administrative accounts, deface websites, or redirect users to malicious phishing sites. Since the vulnerability requires only contributor-level access, it is relatively easy for lower-privileged attackers who have gained foothold in a WordPress installation to escalate their impact significantly by manipulating event data visible to all site visitors.
From an industry standard perspective, this flaw aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. The specific mechanism involves the failure to sanitize output before rendering it in a web browser context. In terms of offensive security tactics, this vulnerability supports techniques described in the MITRE ATT&CK framework under T1059: Command and Control via Application Layer Protocol or more specifically T1189: Drive-by Client Side Web Exploitation when used to deliver malicious payloads. It also relates to privilege escalation scenarios where lower-privileged users leverage stored data manipulation to affect higher-privilege interactions indirectly through victim user sessions.
Mitigation strategies should focus on immediate remediation and long-term security hygiene. Administrators running affected versions must upgrade the Eventin plugin to version 4.1.24 or later, which addresses these sanitization issues. For organizations unable to patch immediately, implementing a Web Application Firewall (WAF) with rules specifically targeting XSS patterns in form submissions related to event scheduling can provide temporary protection. Additionally, enforcing strict Content Security Policy headers that restrict script execution sources can mitigate the impact of successful injection attempts by preventing unauthorized scripts from running even if they are stored on the server. Developers should also review all input handling routines across the plugin to ensure consistent application of escaping functions such as esc_html or wp_kses_post before outputting data, and implement rigorous validation checks for expected data types in schedule slot parameters.