Cross-Site Scripting Vulnerability in EventPrime Plugin by WordPress
CVE-2026-42686

7.1HIGH

Key Information:

Vendor

WordPress
Status
Eventprime
Vendor
CVE Published:
15 June 2026

What is CVE-2026-42686?

The EventPrime plugin, used for managing events on WordPress sites, contains a security flaw that allows for cross-site scripting (XSS) attacks. This vulnerability affects versions up to 4.3.2.1, enabling attackers to inject malicious scripts into web pages viewed by users. By exploiting this weakness, adversaries can compromise user sessions, redirect users to malicious sites, or manipulate the web interface. Website owners using this version of EventPrime should take immediate action to update to the latest version or apply mitigations to protect against potential XSS attacks.

Affected Version(s)

EventPrime <= 4.3.2.1

References

https://patchstack.com/database/wordpress/plugin/eventpri...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hhhai | Patchstack Bug Bounty Program
.