Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?EventPrimeEventin – Event Calendar, Tickets, Registration, Booking & WooCommerceCP Multi View Event CalendarEventON - WordPress Virtual Event CalendarQuick Event CalendarWordPress Event Manager, Event Calendar and BookingEvent Calendar WD prior to version 1.0.94Next Event Calendar
Plugin · wp-event-solution
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
58 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce safe? The full page →
Oct 24, 2026WP Event Solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112844 · affects up to 4.1.26 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.
Oct 16, 2026WP Event Solution: Missing AuthorizationCVE-2026-110380 · affects up to 4.1.26 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.
Oct 13, 2026WP Event Solution: Missing AuthorizationCVE-2026-109898 · affects up to 4.1.25 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
Oct 6, 2026Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.CVE-2026-97300 · affects up to 4.1.25 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.
Oct 5, 2026WP Event Solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · affects up to 4.1.25 · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
Oct 5, 2026WP Event Solution: Missing AuthorizationCVE-2026-103684 · affects up to 4.1.25 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.
Sep 16, 2026Eventin: Does not verify that a completed payment corresponds to the order it is applied toCVE-2026-84906 · fixed in 4.1.24 · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
Sep 16, 2026Eventin: Does not properly authorise order finalisationCVE-2026-84907 · fixed in 4.1.24 · reported by WPScanLow 3.7
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.
Sep 16, 2026Eventin: Does not verify a user's capability to create accountsCVE-2026-84905 · fixed in 4.1.24 · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
Sep 16, 2026Eventin: Does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwardsCVE-2026-77702 · fixed in 4.1.24 · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
Sep 15, 2026Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce: Privilege EscalationCVE-2026-75983 · affects up to 4.1.23 · reported by WordfenceHigh 7.5
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 15, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Stored Cross-Site ScriptingCVE-2026-15402 · affects up to 4.1.23 · reported by WordfenceMedium 6.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-11821 · affects up to 4.1.17 · reported by WordfenceMedium 5.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Local File InclusionCVE-2026-15667 · affects up to 4.1.22 · reported by WordfenceHigh 7.5
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Local File InclusionCVE-2026-15406 · affects up to 4.1.22 · reported by WordfenceHigh 7.5
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 8, 2026WP Event Solution (Eventin): Missing AuthorizationCVE-2026-12956 · affects up to 4.1.22 · reported by WordfenceMedium 5.3
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Eventin: Does not properly check authorization on several of its event-management REST routesCVE-2026-84901 · fixed in 4.1.22 · reported by WPScanMedium 4.9
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
Sep 5, 2026Eventin: Does not properly validate a template path value before using it to include a local fileCVE-2026-84898 · fixed in 4.1.21 · reported by WPScanMedium 6.6
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files.
Sep 2, 2026Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.CVE-2026-82223 · affects up to 4.1.22 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.
Aug 26, 2026Eventin: Does not properly restrictCVE-2026-77694 · fixed in 4.1.19 · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken.
Aug 26, 2026Eventin: Does not restrict access to non-published content by status or ownership in one of its REST API namespacesCVE-2026-13172 · fixed in 4.1.22 · reported by WPScanMedium 5.3
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of password-protected ones.
Aug 21, 2026Eventin: Does not validate a user-supplied webhook URL stored on events nor verify event ownershipCVE-2026-13176 · fixed in 4.1.21 · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.
Aug 19, 2026Eventin: Does not verify ownership before allowing schedule records to be modified or deletedCVE-2026-13175 · fixed in 4.1.21 · reported by WPScanMedium 6.5
The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.
Aug 19, 2026Eventin: Does not verify ownership or capability before deleting user accountsCVE-2026-13174 · fixed in 4.1.21 · reported by WPScanHigh 7.2
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.
Aug 19, 2026Eventin: Does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creationCVE-2026-13173 · fixed in 4.1.21 · reported by WPScanLow 2.7
The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.
Aug 19, 2026Eventin: Does not properly verify ownership of events before allowing them to be modifiedCVE-2026-13169 · fixed in 4.1.21 · reported by WPScanHigh 8.1
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.
Aug 13, 2026Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.CVE-2026-28174 · affects up to 4.1.18 · reported by PatchstackMedium 6.5
Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.
Aug 13, 2026Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.CVE-2026-28173 · affects up to 4.1.19 · reported by PatchstackHigh 7.1
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
Aug 12, 2026Eventin: Does not properly restrict access to individual order recordsCVE-2026-13177 · fixed in 4.1.20 · reported by WPScanMedium 4.3
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.
Aug 12, 2026Eventin: Does not perform an authorization check on its waiting-list registration handlerCVE-2026-13171 · fixed in 4.1.20 · reported by WPScanHigh 8.2
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
Aug 12, 2026Eventin: Does not properly restrict access to stored customer recordsCVE-2026-13168 · fixed in 4.1.20 · reported by WPScanMedium 6.5
The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.
Aug 10, 2026Eventin: Does not properly validate a template path setting before using it to include a local fileCVE-2026-13170 · fixed in 4.1.20 · reported by WPScanHigh 7.2
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
Aug 6, 2026Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.CVE-2026-66451 · affects up to 4.1.9 · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.
Jul 30, 2026Eventin: Does not properly authorize order creation and accepts an attacker-supplied order statusCVE-2026-13178 · fixed in 4.1.16 · reported by WPScanHigh 7.5
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.
Jul 10, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-13039 · affects up to 4.1.15 · reported by WordfenceMedium 5.3
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.
Jul 10, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Stored Cross-Site ScriptingCVE-2026-12924 · affects up to 4.1.15 · reported by WordfenceMedium 6.4
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 16, 2026WP Event Solution: Missing AuthorizationCVE-2025-68045 · affects up to 4.1.12 · reported by PatchstackHigh 7.5
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.12.
Jun 15, 2026Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.CVE-2026-40776 · affects up to 4.1.8 · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.
Jan 22, 2026Eventin: Deserialization of Untrusted DataCVE-2025-68047 · affects up to 4.1.3 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.
Jan 9, 2026Eventin – Event Manager, Events Calendar, Event Tickets and Registrations: Unauthorized modification of dataCVE-2025-14657 · affects up to 4.0.51 · reported by WordfenceHigh 7.2
The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 23, 2025Events Calendar, Event Booking, Registrations and Event Tickets – Eventin: Server-Side Request ForgeryCVE-2025-7813 · affects up to 4.0.37 · reported by WordfenceHigh 7.2
The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 via the proxy_image function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 14, 2025Eventin: Deserialization of Untrusted DataCVE-2025-49869 · affects up to 4.0.31 · reported by PatchstackHigh 8.8
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.0.31.
Aug 8, 2025Eventin: Privilege escalationCVE-2025-4796 · affects up to 4.0.34 · reported by WordfenceHigh 8.8
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 27, 2025Eventin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49321 · affects up to 4.0.28 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Eventin wp-event-solution allows Reflected XSS.This issue affects Eventin: from n/a through <= 4.0.28.
May 23, 2025Eventin: Incorrect Privilege AssignmentCVE-2025-47539 · affects up to 4.0.26 · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through <= 4.0.26.
May 14, 2025Eventin: Relative Path TraversalCVE-2025-47445 · affects up to 4.0.26 · reported by PatchstackHigh 7.5
Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.
May 8, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Arbitrary file readCVE-2025-3419 · affects up to 4.0.26 · reported by WordfenceHigh 7.5
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
Apr 16, 2025Eventin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39584 · affects up to 4.0.25 · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.25.
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2025-1770 · affects up to 4.0.24 · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized modification of dataCVE-2025-1766 · affects up to 4.0.24 · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 25, 2025Eventin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26964 · affects up to 4.0.20 · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.20.
Dec 31, 2024Eventin: Path Traversal: '.../...//'CVE-2024-56213 · affects up to 4.0.7 · reported by PatchstackMedium 6.5
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7.
Dec 9, 2024Eventin: Missing AuthorizationCVE-2023-49756 · affects up to 3.3.52 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventin: from n/a through <= 3.3.52.
Sep 27, 2024Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2024-7149 · affects up to 4.0.8 · reported by WordfenceHigh 8.8
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 1, 2024Eventin: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39648 · affects up to 4.0.5 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 4.0.5.
Jul 21, 2024Eventin: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37507 · affects up to 3.3.57 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 3.3.57.
Jul 17, 2024Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized data importationCVE-2024-6033 · affects up to 4.0.4 · reported by WordfenceMedium 4.3
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, speakers, schedules and attendee data.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 9, 2024Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin: Unauthorized access of dataCVE-2024-1122 · affects up to 3.3.50 · reported by WordfenceMedium 5.3
The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.