CVE-2026-13176

The Eventin WordPress plugin prior to version 4.1.21 is vulnerable due to inadequate validation of user-supplied webhook URLs, enabling users with contributor-level access or higher to initiate blind server-side requests to arbitrary external hosts. This could lead to potential information leakage or further exploitation of the server. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate these risks.