PT-2026-1749 · Unknown+1 · Events Manager+3

Sarawut Poolkhet · Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-14657

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress versions up to and including 4.0.51

Description The Eventin plugin for WordPress is susceptible to unauthorized data modification because of a missing capability check on the post settings function. This allows unauthenticated attackers to alter plugin settings. Additionally, inadequate input sanitization and output escaping of the etn primary color setting allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses a page with Eventin styles loaded. The API endpoint is not specified. The vulnerable parameter is etn primary color.

Recommendations Versions prior to 4.0.51 should be updated.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14657

Affected Products

Events Manager

Event Tickets/Registration

Eventin

Events Calendar

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14657 · Security Note
• https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/Enqueue/register.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2FEnqueue%2Fregister.php · Note
• https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/api-handler.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2Fapi-handler.php · Note
• https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/core/event/api.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fcore%2Fevent%2Fapi.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e4188b26-80f8-41b8-be19-1ddcbd7e39f5?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2009562088914460905 · Twitter Post
• https://twitter.com/CVEnew/status/2009532260673048893 · Twitter Post
• https://t.me/CVEtracker/41799 · Telegram Post