CVE-2026-12924

Name of the Vulnerable Software and Affected Versions Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) versions prior to 4.1.16

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the etn faq content parameter, enabling the injection of arbitrary web scripts into pages that execute when accessed by other users.

Recommendations Update the plugin to version 4.1.16 or later. As a temporary mitigation, restrict access to the etn faq content parameter for users with contributor-level permissions.