CVE-2026-15402: Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with contributor-level access or higher. Exploitation does not require user interaction from the attacker.
Which installations are affected?
Eventin plugin versions up to and including 4.1.23 are affected. The provided data does not identify a configuration prerequisite beyond use of the vulnerable plugin functionality.
What is the impact if exploitation succeeds?
An attacker can store arbitrary web script through the etn_shedule_objective schedule_slot parameter. The script executes when another user accesses a page containing the injected content, potentially exposing or modifying data in that user's browser context.
How can teams check for possible exploitation?
Review Eventin schedule content for unexpected or suspicious values in the etn_shedule_objective schedule_slot field, especially content containing script-like markup or JavaScript. Also review contributor-and-higher accounts that could have created or edited affected schedule content.