Eventer vulnerabilities

The Eventer plugin for WordPress up to version 4.4.2 stores the password reset key in plaintext in the `eventer_verification_code` user meta field. Combined with another vulnerability like SQL Injection (CVE-2026-9700), an unauthenticated attacker can extract this key and take over any user account, including administrators.

The Eventer WordPress plugin in versions up to 0.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. Malicious script injected by an attacker executes in the victim's browser.

The Eventer plugin for WordPress is vulnerable to time-based SQL injection via the 'code' parameter in all versions up to and including 4.4.2 due to insufficient escaping and lack of proper SQL query preparation.