Skip to content
Sign in
7.2 High

CVE-2026-13441 The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting…

Description

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to be enabled, which allows unauthenticated attackers to submit event types via the frontend form; when that setting is disabled, exploitation requires at minimum a subscriber-level authenticated account.

Affected products and versions

Product Affected versions Fixed in
EventPrime – Events Calendar, Bookings and Tickets 4.3 earliest → 4.3.4.2 No fix stated

Other CVEs of EventPrime – Events Calendar, Bookings and Tickets

The 17 CVEs of EventPrime – Events Calendar, Bookings and Tickets →
CVE-2026-1655 The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization… 4.3 Medium CVE-2026-1657 The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and… 5.3 Medium CVE-2025-14507 The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information… 5.3 Medium CVE-2025-12498 The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note… 4.3 Medium
Track this CVE