---
id: CVE-2026-13176
title: >-
  The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied
  webhook URL stored on events nor verify event ownership, allowing users with
  contributor-level access and above to trigger blind server-side requests to
  arbitra…
summary: >-
  The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied
  webhook URL stored on events nor verify event ownership, allowing users with
  contributor-level access and above to trigger blind server-side requests to
  arbitra…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-918
published: '2026-08-21'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:10:00.103'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13176'
references:
  - url: 'https://wpscan.com/vulnerability/41bd0919-6ed3-4280-9657-8114c1b2a0e7/'
    label: contact@wpscan.com
tags:
  - nvd
epss: 0.00325
epssPercentile: 0.2544
ingestedAt: '2026-10-27T18:52:09.909Z'
---

## Overview

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.