CVE-2026-42686

Vulnerability

The EventPrime plugin for WordPress, version 4.3.2.1 and earlier, contains a stored cross-site scripting (XSS) vulnerability affecting subscriber-level users. The vulnerability arises from insufficient input sanitization in the plugin's event calendar management functionality. Attackers can inject arbitrary JavaScript that executes in the context of other users' browsers when they interact with the compromised content. [1]

Exploitation

An attacker with a subscriber account can inject malicious JavaScript payloads through vulnerable input fields in the EventPrime plugin. The injected script is stored and executed when administrators or other users view the affected pages. No additional privileges or user interaction beyond basic subscriber access is required. [1]

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users, including administrators. This can lead to session hijacking, cookie theft, defacement, or redirection to malicious sites. The vulnerability is considered moderately dangerous and is expected to be used in mass-exploit campaigns. [1]

Mitigation

Update the EventPrime plugin to version 4.3.2.2 or later, which resolves the vulnerability. If immediate update is not possible, apply a virtual patch or mitigation rule as provided by Patchstack. [1] No workaround is currently available for unpatched versions.