CVE-2026-27394
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Eventer WordPress plugin in versions up to 0.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. Malicious script injected by an attacker executes in the victim's browser.
Risk Assessment
Session hijacking, data theft, or content modification is possible. The risk affects all sites running the vulnerable plugin version.
Recommendation
Update the Eventer plugin to a version newer than 0.1.1. Until then, consider deactivating the plugin or deploying WAF filters.
Other vulnerabilities in Eventer
See all- CVE-2026-9701Critical
The Eventer plugin for WordPress up to version 4.4.2 stores the password reset key in plaintext in the `eventer_verification_code` user meta field. Combined with another vulnerability like SQL Injection (CVE-2026-9700), an unauthenticated attacker can extract this key and take over any user account, including administrators.
- CVE-2026-9700High
The Eventer plugin for WordPress is vulnerable to time-based SQL injection via the 'code' parameter in all versions up to and including 4.4.2 due to insufficient escaping and lack of proper SQL query preparation.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS