CVE-2026-13441

Name of the Vulnerable Software and Affected Versions EventPrime – Events Calendar, Bookings and Tickets versions prior to 4.3.4.3

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web scripts into pages that execute when accessed by other users. The issue is triggered via the new event type background color parameter. If the Guest Submissions setting allow submission by anonymous user is enabled, unauthenticated attackers can submit event types via the frontend form. Otherwise, exploitation requires at least a subscriber-level authenticated account.

Recommendations Update EventPrime – Events Calendar, Bookings and Tickets to version 4.3.4.3 or later. Disable the allow submission by anonymous user setting to prevent unauthenticated exploitation.