Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce

Vulnerabilities

• CVE-2025-47539unauthenticated≤ 4.0.26

  WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability

  Critical 9.8

• CVE-2025-47445unauthenticated≤ 4.0.26

  WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability

  Critical 9.8

• CVE-2025-68047login required≤ 4.1.3

  WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability

  High 8.8

• CVE-2025-49869login required≤ 4.0.31

  WordPress Eventin Plugin <= 4.0.31 - PHP Object Injection Vulnerability

  High 8.8

• CVE-2025-26964login required≤ 4.0.20

  WordPress Eventin plugin <= 4.0.20 - Local File Inclusion vulnerability

  High 8.8

• CVE-2023-49756login required≤ 3.3.52

  WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal Vulnerability

  High 8.8

• CVE-2025-4796contributor+≤ 4.0.34

  Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover

  High 8.8

• CVE-2025-1770contributor+≤ 4.0.24

  Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion

  High 8.8

• CVE-2024-56213contributor+≤ 4.0.7

  WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability

  High 8.8

• CVE-2024-7149contributor+≤ 4.0.8

  Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion

  High 8.8

• CVE-2025-68045unauthenticated≤ 4.1.12

  WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability

  High 7.5

• CVE-2026-40776unauthenticated≤ 4.1.8

  WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerability

  High 7.5

• CVE-2025-3419unauthenticated≤ 4.0.26

  Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read

  High 7.5

• CVE-2026-75983subscriber+≤ 4.1.23

  Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter

  High 7.5

• CVE-2026-15406login required≤ 4.1.22

  Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter

  High 7.5

• CVE-2025-39584login required≤ 4.0.25

  WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability

  High 7.5

• CVE-2026-15667contributor+≤ 4.1.22

  Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter

  High 7.5

• CVE-2025-14657unauthenticated≤ 4.0.51

  Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross

  High 7.2

• CVE-2025-7813unauthenticated≤ 4.0.37

  Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery

  High 7.2

• CVE-2026-28173customer+≤ 4.1.19

  WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability

  High 7.1

• CVE-2026-82223unauthenticated≤ 4.1.22

  WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability

  Medium 6.5

• CVE-2026-66451unauthenticated≤ 4.1.9

  WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability

  Medium 6.5

• CVE-2026-28174customer+≤ 4.1.18

  WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability

  Medium 6.5

• CVE-2026-15402contributor+≤ 4.1.23

  Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter

  Medium 6.4

• CVE-2026-12924contributor+≤ 4.1.15

  Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter

  Medium 6.4

• CVE-2025-49321unauthenticated · needs a click≤ 4.0.28

  WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) Vulnerability

  Medium 6.1

• CVE-2026-11821subscriber+≤ 4.1.17

  Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint

  Medium 5.4

• CVE-2024-37507login required≤ 3.3.57

  WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2026-12956unauthenticated≤ 4.1.22

  Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter

  Medium 5.3

• CVE-2026-13039unauthenticated≤ 4.1.15

  Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API

  Medium 5.3

• CVE-2025-1766unauthenticated≤ 4.0.24

  Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update

  Medium 5.3

• CVE-2024-1122unauthenticated≤ 3.3.50

  Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export

  Medium 5.3

• CVE-2024-39648high privilege≤ 4.0.5

  WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

  Medium 4.8

• CVE-2026-15398subscriber+≤ 4.1.22

  Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion /

  Medium 4.3

• CVE-2024-6033contributor+≤ 4.0.4

  Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import

  Medium 4.3