EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter

Summary

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's Guest Submissions setting (allow_submission_by_anonymous_user) to be enabled, which allows unauthenticated attackers to submit event types via the frontend form; when that setting is disabled, exploitation requires at minimum a subscriber-level authenticated account.

Timeline

1. Jul 9, 2026, 9:31 AM UTCCVE published
2. Jul 9, 2026, 12:19 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Jul 9, 2026, 12:19 PM UTCRecord last updated

Affected versions

• metagauss EventPrime – Events Calendar, Bookings and Tickets

  through 4.3.4.2

References 8