The Eventin WordPress plugin suffers from a missing capability check in its 'post_settings' function, permitting unauthenticated users to alter plugin settings. This missing authorization (CWE-862) vulnerability affects all versions up to 4.0.51. Moreover, the 'etn_primary_color' setting lacks proper input sanitization and output escaping, enabling stored cross-site scripting (XSS) attacks via arbitrary script injection. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity. No patch or vendor advisory is currently provided.

An unauthenticated attacker can modify plugin settings without authorization, potentially altering site behavior or configuration. The XSS vulnerability allows injection of arbitrary scripts that execute in the context of users visiting pages loading Eventin styles, risking session hijacking, defacement, or other script-based attacks. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation. Avoid exposing the plugin's administrative interfaces to untrusted users. Monitor for updates from the vendor or WordPress plugin repository for an official patch.