Eventin – Event Manager, Events Calendar, Event Tickets and Registrations for WordPress has a missing capability check on the 'post_settings' function that lets attackers change plugin configuration without authentication. Using this flaw they can also inject scripts through the 'etn_primary_color' setting because the input is not sanitized or escaped. These actions give the attacker arbitrary script execution when any user loads a page that includes Eventin styles. The vulnerability is classified as missing authorization (CWE‑862).

WordPress sites running Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) version 4.0.51 or earlier are affected. The plugin is supplied by arraytics and is available via the WordPress plugin repository.

The CVSS score of 7.2 indicates a high impact combined with a medium to high exploitation potential, but the EPSS score of <1% shows that it is presently unlikely to be widely exploited. It is not listed in CISA KEV. The attack vector is through unauthenticated HTTP requests to the plugin’s API endpoint – attackers construct a call to 'post_settings', supply malicious values for 'etn_primary_color', and register the changes, leading to script execution for all site visitors. No network privilege or local access is required and the flaw can be used over normal HTTPS traffic.