CVE-2025-14657

🗓️ 09 Jan 2026 08:15:57Reported by [email protected]Type

Unauthenticated attackers can modify Eventin plugin settings and inject scripts due to missing capability checks and unsanitized input up to 4.0.51.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-14657	9 Jan 202608:38	–	circl
CNNVD	WordPress plugin Eventin 安全漏洞	9 Jan 202600:00	–	cnnvd
CVE	CVE-2025-14657	9 Jan 202607:22	–	cve
Cvelist	CVE-2025-14657 Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'	9 Jan 202607:22	–	cvelist
EUVD	EUVD-2026-1775	9 Jan 202607:22	–	euvd
Patchstack	WordPress Eventin plugin <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' vulnerability	9 Jan 202608:56	–	patchstack
Positive Technologies	PT-2026-1749	9 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-14657	13 Jan 202622:52	–	redhatcve
Vulnrichment	CVE-2025-14657 Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'	9 Jan 202607:22	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (January 5, 2026 to January 11, 2026)	15 Jan 202616:14	–	wordfence

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/Enqueue/register.php
plugins	www.plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/api-handler.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e4188b26-80f8-41b8-be19-1ddcbd7e39f5
plugins	www.plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/core/event/api.php

15 Apr 2026 00:35Current

CVSS 3.17.2

EPSS0.00307