Live › vulnerability › CVE-2026-27394
The abandoned Eventer WordPress plugin (by Jyothis Joy, 1,000+ installs) has a reflected cross-site scripting flaw in version 0.1.1 and earlier. No fixed version exists; 0.1.1 is the latest release and the plugin was last updated in 2018.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
WordPress sites with the old Eventer registration plugin (by Jyothis Joy) at 0.1.1 or earlier are exposed; an unauthenticated attacker crafts a link and the script runs in the browser of whoever clicks it, including a logged-in admin. Sites that do not have this plugin installed can skip it, as can sites using the separate commercial Eventer Event & Booking Manager plugin (different advisories). Patchstack rates it CVSS 7.1 with user interaction required (reflected, not stored).
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| eventer | wordpress-plugin | <= 0.1.1 | – |
Eventer by Jyothis Joy at version 0.1.1 or earlierEventer - WordPress Event & Booking Manager plugin, which has different advisories.)0.1.1 as the latest version, last updated 2018, flagged as likely unmaintainedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-27394")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.