CVE-2026-13441 is a stored cross-site scripting vulnerability in the EventPrime – Events Calendar, Bookings and Tickets WordPress plugin. It arises from improper neutralization of input in the 'new_event_type_background_color' parameter, allowing injection of arbitrary web scripts. Authenticated attackers with custom-level access or higher can exploit this, or unauthenticated attackers if the Guest Submissions feature is enabled. The vulnerability affects all versions up to and including 4.3.4.2. No official patch or remediation level has been published yet.

Successful exploitation can lead to execution of arbitrary scripts in the context of users visiting the injected pages, potentially resulting in session hijacking, defacement, or other malicious actions limited to the confidentiality and integrity of user interactions. The CVSS score of 7.2 indicates high severity with network attack vector, low attack complexity, no privileges required in some cases, and user interaction not required. Availability impact is none.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the Guest Submissions setting (allow_submission_by_anonymous_user) to prevent unauthenticated exploitation. Additionally, restrict user roles and permissions to limit access to custom-level or higher accounts. Monitor official metagauss communications for updates and apply patches promptly once released.