Description

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-15T07:16:26.583Z",
  "pubdate": "2026-09-15T07:16:26.583Z",
  "executiveSummary": "The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from improper input sanitization and output encoding within the 'etn_shedule_objective' schedule_slot parameter.\nThe vulnerability allows authenticated attackers with contributor-level privileges or higher to inject malicious JavaScript into the application. Once stored, this payload executes in the context of a user's browser session whenever they access the affected page. The potential impact is significant, as it permits unauthorized script execution, session hijacking, defacement, or redirection to malicious sites.\nAll versions of the Eventin plugin up to, and including, 4.1.23 are confirmed to be vulnerable. Successful exploitation requires an attacker to possess valid WordPress credentials with at least contributor permissions. The persistence of the payload ensures that the malicious script remains active until removed or the vulnerability is remediated. This represents a critical risk to site integrity and user session security, particularly if administrative users access the compromised event management pages.",
  "technicalDetails": "The vulnerability is classified as a Stored Cross-Site Scripting (XSS) flaw, residing in the plugin's schedule management functionality. Specifically, the 'etn_shedule_objective' parameter, which handles the 'schedule_slot' input, fails to perform adequate server-side sanitization on user-supplied data before committing it to the WordPress database.\nThe root cause of this vulnerability is the absence of rigorous input validation and the lack of appropriate context-aware output escaping when rendering the 'schedule_slot' content in the event interface. Because the plugin processes this parameter without treating it as untrusted input, an attacker can craft a payload containing malicious HTML or JavaScript tags (e.g., <script>alert(1)</script> or event-handler-based injections).\nThe attack flow proceeds as follows: First, an authenticated attacker with contributor access navigates to the event scheduling module within the Eventin dashboard. During the creation or modification of a schedule, the attacker intercepts the HTTP request or utilizes the plugin's UI to inject a malicious script into the 'schedule_slot' parameter. The server accepts this request, storing the unfiltered payload directly into the database associated with the Eventin plugin.\nWhen a victim, such as an administrator or another user, navigates to the page where this schedule is rendered, the plugin retrieves the malicious payload from the database and inserts it directly into the HTML document object model (DOM) without sanitization. The victim's browser interprets the injected script as legitimate code originating from the trusted origin, leading to unauthorized execution within the victim's security context.\nPost-exploitation impact is severe, as the attacker can perform actions on behalf of the victim. This includes, but is not limited to, capturing sensitive session cookies (leading to account takeover), performing unauthorized administrative actions, modifying page content, or redirecting users to credential-harvesting sites. Since the script executes upon the page loading, the attack does not require interaction from the victim beyond simply viewing the compromised content, making it a highly effective mechanism for persistence and privilege escalation within the WordPress environment.\nThe vulnerability is restricted to the components responsible for processing the 'etn_shedule_objective' and the 'schedule_slot' field, and the lack of proper defensive programming at the application layer facilitates this bypass of standard WordPress security practices."
}