CVE-2026-13176
âšī¸ lowSummary
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
CVSS Score
2.7
Low
EPSS Score
0.2
Exploit Probability
Published Date
2026-08-21
First Seen: 2026-08-22
đ Relative Risk Intelligence
This CVE is Lower Risk - more severe than 1.5% of all 348,756 vulnerabilities in our database.
#343,548
Below average severity
Severity Percentile
đ¯ CISA SSVC Assessment Updated: Aug 21, 2026
đ Exploitation Status
None
No known exploits
âī¸ Automatable
NO
Requires human interaction
đĨ Technical Impact
Partial
Limited system impact
đ Discovered By
Yaswanth Reddy Sunkara
WPScan (coordinator)
SSVC data provided by
CISA
Last Modified
2026-08-21
Source
NVD đ
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CWE IDs (Weakness Types)