{"id":"CVE-2026-13176","title":"The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitra…","summary":"The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitra…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-918"],"published":"2026-08-21","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:10:00.103","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13176","references":[{"url":"https://wpscan.com/vulnerability/41bd0919-6ed3-4280-9657-8114c1b2a0e7/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00325,"epssPercentile":0.2544,"ingestedAt":"2026-10-27T18:52:09.909Z","slug":"CVE-2026-13176","body":"## Overview\n\nThe Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}