CVE-2025-14657

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14657", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-13T12:25:43.872Z", "datePublished": "2026-01-09T07:22:12.728Z", "dateUpdated": "2026-04-08T17:29:31.164Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:31.164Z"}, "affected": [{"vendor": "arraytics", "product": "Eventin \u2013 Event Calendar, Event Registration, Tickets & Booking (AI Powered)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.0.51", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Eventin \u2013 Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded."}], "title": "Eventin \u2013 Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e4188b26-80f8-41b8-be19-1ddcbd7e39f5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/Enqueue/register.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2FEnqueue%2Fregister.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/api-handler.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2Fapi-handler.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/core/event/api.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fcore%2Fevent%2Fapi.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sarawut Poolkhet"}], "timeline": [{"time": "2025-12-11T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-13T12:42:56.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-08T18:45:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T18:07:15.776405Z", "id": "CVE-2025-14657", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:07:23.696Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14657", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T18:07:15.776405Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:07:20.140Z"}}], "cna": {"title": "Eventin \u2013 Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'", "credits": [{"lang": "en", "type": "finder", "value": "Sarawut Poolkhet"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "arraytics", "product": "Eventin \u2013 Event Calendar, Event Registration, Tickets & Booking (AI Powered)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.0.51"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-11T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-13T12:42:56.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-08T18:45:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e4188b26-80f8-41b8-be19-1ddcbd7e39f5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/Enqueue/register.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2FEnqueue%2Fregister.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/api-handler.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2Fapi-handler.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/core/event/api.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fcore%2Fevent%2Fapi.php"}], "descriptions": [{"lang": "en", "value": "The Eventin \u2013 Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:31.164Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14657", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:31.164Z", "dateReserved": "2025-12-13T12:25:43.872Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-09T07:22:12.728Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eventin \u2013 Event Calendar, Event Registration, Tickets & Booking (AI Powered)", "vendor": "arraytics", "versions": [{"lessThanOrEqual": "4.0.51", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Eventin \u2013 Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded."}, {"lang": "es", "value": "El plugin Eventin \u2013 Event Manager, Events Calendar, Event Tickets and Registrations para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una falta de comprobaci\u00f3n de capacidad en la funci\u00f3n 'post_settings' en todas las versiones hasta la 4.0.51, inclusive. Esto hace posible que atacantes no autenticados modifiquen la configuraci\u00f3n del plugin. Adem\u00e1s, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en la configuraci\u00f3n 'etn_primary_color', esto permite a atacantes no autenticados inyectar scripts web arbitrarios que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina donde se carguen los estilos de Eventin."}], "id": "CVE-2025-14657", "lastModified": "2026-06-17T08:36:21.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14657", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T18:07:15.776405Z", "version": "2.0.3"}}]}, "published": "2026-01-09T08:15:57.487", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/Enqueue/register.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2FEnqueue%2Fregister.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/base/api-handler.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fbase%2Fapi-handler.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3429942/wp-event-solution/trunk/core/event/api.php?old=3390273&old_path=wp-event-solution%2Ftrunk%2Fcore%2Fevent%2Fapi.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e4188b26-80f8-41b8-be19-1ddcbd7e39f5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:11:30.592186+00:00", "value": {"mitigation_remediation": ["Update Eventin to the latest released version (4.0.52 or later) that enforces capability checks on the 'post_settings' endpoint and sanitizes the 'etn_primary_color' input.", "If an update is not possible, restrict unauthenticated access to the 'post_settings' API endpoint, for example by adding a WordPress capability requirement or by implementing IP whitelisting or a firewall rule that blocks unauthenticated calls to that endpoint.", "Deploy a temporary workaround by resetting the 'etn_primary_color' setting to a neutral, safe value, removing any custom scripts, and applying a strict Content Security Policy that blocks script execution from inline or external sources on pages that load Eventin styles."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Data Modification and Stored XSS"}, "threat_synthesis": {"affected_systems": "WordPress sites running Eventin \u2013 Event Calendar, Event Registration, Tickets & Booking (AI Powered) version 4.0.51 or earlier are affected. The plugin is supplied by arraytics and is available via the WordPress plugin repository.", "description_and_impact": "Eventin \u2013 Event Manager, Events Calendar, Event Tickets and Registrations for WordPress has a missing capability check on the 'post_settings' function that lets attackers change plugin configuration without authentication. Using this flaw they can also inject scripts through the 'etn_primary_color' setting because the input is not sanitized or escaped. These actions give the attacker arbitrary script execution when any user loads a page that includes Eventin styles. The vulnerability is classified as missing authorization (CWE\u2011862).", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high impact combined with a medium to high exploitation potential, but the EPSS score of <1% shows that it is presently unlikely to be widely exploited. It is not listed in CISA KEV. The attack vector is through unauthenticated HTTP requests to the plugin\u2019s API endpoint \u2013 attackers construct a call to 'post_settings', supply malicious values for 'etn_primary_color', and register the changes, leading to script execution for all site visitors. No network privilege or local access is required and the flaw can be used over normal HTTPS traffic."}}}}, "created": "2026-01-09T13:24:02.559129+00:00", "updated": "2026-04-20T21:15:20.637771+00:00", "vendors": ["arraytics", "arraytics$PRODUCT$eventin", "wordpress", "wordpress$PRODUCT$wordpress"]}