PT-2026-1749 · Unknown+1 · Events Manager+3

Sarawut Poolkhet · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2025-14657

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress versions up to and including 4.0.51

Description The Eventin plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the post settings function. This allows unauthenticated attackers to alter plugin settings. Additionally, inadequate input sanitization and output escaping of the etn primary color setting allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses a page with Eventin styles loaded. The API endpoint is not specified. The vulnerable parameter is etn primary color.

Recommendations Versions prior to 4.0.51 should be updated.

Correção

LPE

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14657

Produtos afetados

Events Manager

Event Tickets/Registration

Eventin

Events Calendar

Referências · 8

• https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/Enqueue/register.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2FEnqueue%2Fregister.php · Nota
• https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/api-handler.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2Fapi-handler.php · Nota
• https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/core/event/api.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fcore%2Fevent%2Fapi.php · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/e4188b26-80f8-41b8-be19-1ddcbd7e39f5?source=cve · Nota
• https://twitter.com/VulmonFeeds/status/2009562088914460905 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2009532260673048893 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-14657 · Nota de Segurança
• https://t.me/CVEtracker/41799 · Publicação no Telegram