← back to popular plugins
wordfence / plugin · wp-event-solution
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce
wp-event-solution
total installs
10,000
total vulns
50
critical
1
high
12
medium
37
low
0
latest vuln
—
patched
50
unpatched
0
avg time to patch
—
vulnerabilities
(50)
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
medium
✓ patched
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1.25. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
medium
✓ patched
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1.25. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Missing Authorization
medium
✓ patched
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1.25. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.25 - Unauthenticated Information Exposure
medium
✓ patched
cve id
CVE-2026-105073 ↗
cvss score
5.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Oct 5, 2026
The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.25. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
high
✓ patched
cve id
CVE-2026-75983 ↗
cvss score
7.5
cwe
CWE-269: Improper Privilege Management
published
Sep 14, 2026
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.
Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
medium
✓ patched
cve id
CVE-2026-15402 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Sep 14, 2026
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Eventin <= 4.1.23 - Missing Authorization
medium
✓ patched
The Eventin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1.23. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin <= 4.1.23 - Missing Authorization
medium
✓ patched
The Eventin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1.23. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Eventin <= 4.1.23 - Unauthenticated Payment Bypass
medium
✓ patched
cve id
CVE-2026-84906 ↗
cvss score
5.3
cwe
CWE-602: Client-Side Enforcement of Server-Side Security
published
Sep 14, 2026
The Eventin plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 4.1.23. This is due to a lack of server-side payment verification. This makes it possible for unauthenticated attackers to bypass payments.
Eventin <= 4.1.23 - Missing Authorization
medium
✓ patched
The Eventin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1.23. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
medium
✓ patched
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass payment for paid events, fraudulently mark orders as completed, deplete ticket inventory, and trigger confirmation emails for tickets never purchased. This is exploitable by unauthenticated attackers because the wp_rest nonce is publicly emitted on every frontend page, and the order creation endpoint mints and returns an order_access_token to any caller possessing that nonce — giving unauthenticated users all credentials required to reach the privileged update_booking_status branch.
Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
medium
✓ patched
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
high
✓ patched
cve id
CVE-2026-15667 ↗
cvss score
7.5
cwe
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
published
Sep 8, 2026
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
high
✓ patched
cve id
CVE-2026-15406 ↗
cvss score
7.5
cwe
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
published
Sep 8, 2026
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
medium
✓ patched
The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Path Traversal
medium
✓ patched
cve id
CVE-2026-84898 ↗
cvss score
6.5
cwe
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published
Sep 5, 2026
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to 4.1.21. This is due to insufficient validation of a user supplied path. This makes it possible for authenticated attackers, with contributor-level access and above, to access files and directories outside of the intended directory.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Missing Authorization
medium
✓ patched
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to 4.1.22. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.22 - Missing Authorization
medium
✓ patched
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1.22. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Unauthenticated Information Exposure
medium
✓ patched
cve id
CVE-2026-13172 ↗
cvss score
5.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Aug 26, 2026
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 4.1.22 (exclusive). This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Server-Side Request Forgery
medium
✓ patched
cve id
CVE-2026-13176 ↗
cvss score
6.4
cwe
CWE-918: Server-Side Request Forgery (SSRF)
published
Aug 24, 2026
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 4.1.21. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.19 - Unauthenticated Order Completion
medium
✓ patched
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to 4.1.19 (exclusive). This makes it possible for unauthenticated attackers to complete orders.
Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification
medium
✓ patched
cve id
CVE-2026-13175 ↗
cvss score
6.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Aug 17, 2026
The Eventin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.1.20. This is due to the permission check reading the subject ID from the request body parameter `ids` while the handler read it from the URL parameter `id`, allowing an attacker to authorize against their own schedule and execute against a victim's. This makes it possible for authenticated attackers, with contributor-level access and above, to delete or modify schedules belonging to other users by supplying a victim's schedule ID in the URL path while carrying their own schedule ID in the request body to pass the ownership check.
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover
medium
✓ patched
cve id
CVE-2026-13169 ↗
cvss score
4.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Aug 17, 2026
The Eventin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.1.20. This is due to a mismatch between the parameter read during authorization (body `ids`) and the parameter read during execution (URL `id`), allowing a body-supplied `ids` value to satisfy the ownership check while the handler operated on a different, attacker-chosen resource. This makes it possible for authenticated attackers, with contributor-level access and above, to modify, delete, or take ownership of arbitrary events belonging to other users by supplying their own resource ID in the request body while targeting a victim's resource ID in the URL path.
Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion
medium
✓ patched
cve id
CVE-2026-13174 ↗
cvss score
4.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Aug 17, 2026
The Eventin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.1.20. This is due to the permission check preferring the `ids` body parameter over the URL path `id`, allowing the check to pass against the attacker's own account while the deletion executed against the victim's account in the path. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary speaker or organizer user accounts by supplying their own user ID in the request body `ids` parameter while targeting a victim's account ID in the URL path.
Eventin <= 4.1.20 - Missing Authorization
medium
✓ patched
The Eventin plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 4.1.20. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure
medium
✓ patched
cve id
CVE-2026-28174 ↗
cvss score
4.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Aug 13, 2026
The Event SOlution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.1.18. This makes it possible for authenticated attackers, with customer-level access and above, to extract sensitive user or configuration data.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
medium
✓ patched
cve id
CVE-2026-13168 ↗
cvss score
4.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Aug 13, 2026
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 4.1.20. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user or configuration data.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
medium
✓ patched
cve id
CVE-2026-13177 ↗
cvss score
4.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Aug 13, 2026
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 4.1.20. This makes it possible for authenticated attackers, with contributor-level access and above, to extract sensitive user or configuration data.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.19 - Authenticated (Customer+) Arbitrary Content Deletion
medium
✓ patched
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.1.19. This makes it possible for authenticated attackers, with Custom-level access and above, to delete arbitrary content.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Unauthenticated User Account Creation
medium
✓ patched
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to user account creation in all versions up to 4.1.20 (exclusive).This makes it possible for unauthenticated attackers to create user accounts when user registration is disabled.
Eventin <= 4.1.19 - Authenticated (Editor+) Local File Inclusion
medium
✓ patched
cve id
CVE-2026-13170 ↗
cvss score
6.6
cwe
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published
Aug 6, 2026
The Eventin plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.19. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.9 - Missing Authorization
medium
✓ patched
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.1.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.16 - Unauthenticated Payment Bypass
medium
✓ patched
The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to 4.1.16 (exclusive). This makes it possible for unauthenticated attackers to bypass payments by manipulating order statuses.
Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
medium
✓ patched
cve id
CVE-2026-12924 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Jul 9, 2026
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
medium
✓ patched
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression — the same function and endpoint were previously patched but the fix did not persist through subsequent releases.
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization
medium
✓ patched
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.1.12. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization
medium
✓ patched
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.1.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
medium
✓ patched
The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the get_item_permissions_check() function in all versions up to, and including, 4.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order data including customer PII (name, email, phone) by iterating order IDs.
Eventin <= 4.1.3 - Authenticated (Contributor+) PHP Object Injection
high
✓ patched
cve id
CVE-2025-68047 ↗
cvss score
7.5
cwe
CWE-502: Deserialization of Untrusted Data
published
Jan 22, 2026
The Eventin plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.1.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'
high
✓ patched
The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded.
Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery
high
✓ patched
cve id
CVE-2025-7813 ↗
cvss score
7.2
cwe
CWE-918: Server-Side Request Forgery (SSRF)
published
Aug 22, 2025
The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 via the proxy_image function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Eventin <= 4.0.31 - Authenticated (Contributor+) PHP Object Injection
high
✓ patched
cve id
CVE-2025-49869 ↗
cvss score
7.5
cwe
CWE-502: Deserialization of Untrusted Data
published
Aug 13, 2025
The Eventin plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.0.31 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
high
✓ patched
cve id
CVE-2025-4796 ↗
cvss score
8.8
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Aug 8, 2025
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Eventin <= 4.0.28 - Reflected Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-49321 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Jun 23, 2025
The Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.0.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read
high
✓ patched
cve id
CVE-2025-3419 ↗
cvss score
7.5
cwe
CWE-73: External Control of File Name or Path
published
May 7, 2025
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation
critical
✓ patched
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the import_items() function in all versions up to, and including, 4.0.26. This makes it possible for unauthenticated attackers to import users that can have the administrator role leading to privilege escalation.
Eventin <= 4.0.25 - Authenticated (Contributor+) Local File Inclusion
high
✓ patched
cve id
CVE-2025-39584 ↗
cvss score
8.8
cwe
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
published
Apr 16, 2025
The Eventin plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.0.25 via the 'events_tab' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
high
✓ patched
cve id
CVE-2025-1770 ↗
cvss score
8.8
cwe
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
published
Mar 19, 2025
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
medium
✓ patched
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
Eventin <= 4.0.20 - Authenticated (Contributor+) Local File Inclusion
high
✓ patched
cve id
CVE-2025-26964 ↗
cvss score
8.8
cwe
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
published
Feb 23, 2025
The Eventin plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.0.20. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.