CVE-2026-42686: WordPress EventPrime plugin <= 4.3.2.1 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a stored or reflected Cross-Site Scripting (XSS) vulnerability in the EventPrime WordPress plugin, affecting versions 4.3.2.1 and earlier. The vulnerability is reachable over the network and requires only a low-privilege (subscriber-level) account, with no victim interaction needed to trigger it. Successful exploitation allows an attacker to inject malicious scripts into the application, degrading availability significantly and enabling limited content tampering. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends crafted HTTP requests to the publicly exposed WordPress instance.

• AuthenticationRequired

  A low-privilege account (subscriber level or equivalent) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed for the attacker to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• An attacker can inject malicious scripts into the EventPrime plugin context, which execute in the browser of any user who loads the affected page.
• Integrity impact allows modification of page content visible to other users, enabling phishing lures or defacement of event listings.
• Availability impact is rated High, meaning the attacker can disrupt the affected service or cause it to become unresponsive for legitimate users.
• Confidentiality impact is rated None; the exploit does not directly expose stored data such as session tokens or user records through the CVSS-defined impact scope.