{"id":"CVE-2026-27394","kind":"vulnerability","aliases":["CVE-2026-27394"],"related":[],"title":"Eventer WordPress plugin: unauthenticated XSS through versions 0.1.1 and earlier","description":"Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.","summary":"The abandoned Eventer WordPress plugin (by Jyothis Joy, 1,000+ installs) has a reflected cross-site scripting flaw in version 0.1.1 and earlier. No fixed version exists; 0.1.1 is the latest release and the plugin was last updated in 2018.","severity":"medium","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"eventer","fixed":[],"affected":"<= 0.1.1","ecosystem":"wordpress-plugin"}],"ecosystems":[],"tags":["eventer","package","reflected-xss","unmaintained","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"In WordPress admin, Plugins > Installed Plugins: look for 'Eventer' by Jyothis Joy at version 0.1.1 or earlier. Or check that wp-content/plugins/eventer/ exists. (Not to be confused with the separate commercial 'Eventer - WordPress Event & Booking Manager' plugin, which has different advisories.)","fix":"No fix: the wordpress.org listing shows 0.1.1 as the latest version, last updated 2018, flagged as likely unmaintained. Deactivate and delete the plugin and replace it with a maintained event/registration plugin.","status":"open","published_at":"2026-10-29T16:18:08+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:30:00+00:00","updated_at":"2026-10-29T16:47:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:30:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Eventer WordPress plugin: unauthenticated XSS through versions 0.1.1 and earlier","impact":"medium","summary":"Eventer, a WordPress event plugin, has a cross-site scripting flaw reachable without logging in. An attacker can inject script that runs in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","eventer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the affected site","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-27394) for the affected plugin source and whether a fixed version exists beyond 0.1.1.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Eventer plugin at version 0.1.1 or earlier are exposed, since no login is needed to send the malicious input. The sources do not say which Eventer features or settings are required to trigger the flaw. Sites that do not run Eventer can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":4062,"output_tokens":470,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-27394) for the affected plugin source and whether a fixed version exists beyond 0.1.1.","search":"'-2026':12A,15A '-27394':13A,16A '0.1.1':8A,50B,57B,77C '000':38B '1':37B '2018':69B 'abandon':30B 'cross':44B,71C 'cross-sit':43B 'cve':11A,14A 'earlier':10A,52B 'event':1A,18B,31B,76C 'eventer':17A 'exist':56B 'fix':54B 'flaw':47B 'instal':39B 'joy':36B 'jyothi':35B 'last':66B 'latest':60B 'packag':19B 'plugin':3A,27B,33B,64B 'reflect':21B,42B 'reflected-xss':20B 'releas':61B 'script':46B,73C 'site':45B,72C 'unauthent':4A,70C 'unmaintain':23B 'updat':67B 'version':7A,49B,55B,78C 'wordpress':2A,24B,26B,32B 'wordpress-plugin':25B 'xss':5A,22B,28B,74C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the old Eventer registration plugin (by Jyothis Joy) at 0.1.1 or earlier are exposed; an unauthenticated attacker crafts a link and the script runs in the browser of whoever clicks it, including a logged-in admin. Sites that do not have this plugin installed can skip it, as can sites using the separate commercial Eventer Event & Booking Manager plugin (different advisories). Patchstack rates it CVSS 7.1 with user interaction required (reflected, not stored).","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-27394","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27394","severity":null,"published_at":"2026-10-29T16:18:08+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-27394:1075","url":null,"severity":null,"published_at":"2026-10-29T16:38:11+00:00","modified_at":"2026-10-29T16:38:11+00:00","first_seen_at":"2026-10-29T16:38:11+00:00","fetched_at":"2026-10-29T16:38:11+00:00","note":"Read wp.org plugin page (0.1.1 latest, unmaintained since 2018) and Patchstack entry (reflected XSS, UI required, no patch). Severity high->medium: reflected with user interaction; sources vary 6.1-7.1. Nothing verified: Patchstack is a third party, vendor page does not mention the flaw. No exploitation or PoC seen; no social search done (low-profile plugin)."}],"documents":[{"id":17802,"url":"https://wordpress.org/plugins/eventer/","title":"Eventer (wordpress.org plugin page): v0.1.1 latest, last updated 2018, unmaintained","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17803,"url":"https://patchstack.com/database/wordpress/plugin/eventer/vulnerability/wordpress-eventer-plugin-0-1-1-reflected-cross-site-scripting-xss-vulnerability","title":"Patchstack: Eventer <= 0.1.1 reflected XSS, no official patch","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}