CVE-2026-13390

MediumCVSS 5.3/10Last modified Jul 27, 2026

Description

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store arbitrary content in a hidden comment record.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2026
Last modified
Jul 27, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-133927.2The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrCVE-2026-133933.5The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before stoCVE-2026-133958.6The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameCVE-2026-133977.5HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function neverCVE-2026-133997.5The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, alloCVE-2026-13409.8A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.CVE-2026-134006.1Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The CVE-2026-134017.5XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never CVE-2026-134025.3The Royal Addons for Elementor WordPress plugin before 1.7.1063 does not check the post status of menu items or the templates they referencCVE-2026-134045.3The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publiCVE-2026-134056.6The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a filCVE-2026-134065.3The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy te
CVE-2026-13390: Medium severity, CVSS 5.3 | Vulnix