Plugin icon

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

wp-event-solution

Vulnerabilities:

24

Last Updated:

July 24, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-07-13
Title
Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
Fixed in
Fixed in 4.1.16
CVSS
n/a
Published
2026-07-09
Title
Eventin < 4.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
Fixed in
Fixed in 4.1.16
CVSS
5.5 (medium)
Published
2026-07-09
Title
Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
Fixed in
Fixed in 4.1.16
CVSS
5.3 (medium)
Published
2026-06-15
Title
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) < 4.1.13 - Missing Authorization
Fixed in
Fixed in 4.1.13
CVSS
5.3 (medium)
Published
2026-04-29
Title
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) < 4.1.9 - Missing Authorization
Fixed in
Fixed in 4.1.9
CVSS
5.3 (medium)
Published
2026-04-13
Title
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) < 4.1.9 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Fixed in
Fixed in 4.1.9
CVSS
4.3 (medium)
Published
2026-01-22
Title
Eventin < 4.1.4 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 4.1.4
CVSS
7.5 (high)
Published
2026-01-08
Title
Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) < 4.0.52 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'
Fixed in
Fixed in 4.0.52
CVSS
7.2 (high)
Published
2025-08-22
Title
Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin < 4.0.38 - Unauthenticated Server-Side Request Forgery
Fixed in
Fixed in 4.0.38
CVSS
7.2 (high)
Published
2025-08-13
Title
Eventin < 4.0.32 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 4.0.32
CVSS
7.5 (high)
Published
2025-08-08
Title
Eventin < 4.0.35 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
Fixed in
Fixed in 4.0.35
CVSS
8.8 (high)
Published
2025-06-23
Title
Eventin < 4.0.29 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.0.29
CVSS
6.1 (medium)
Published
2025-05-07
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.27 - Unauthenticated Arbitrary File Read
Fixed in
Fixed in 4.0.27
CVSS
7.5 (high)
Published
2025-05-07
Title
Eventin < 4.0.27 - Missing Authorization to Unauthenticated Privilege Escalation
Fixed in
Fixed in 4.0.27
CVSS
9.8 (critical)
Published
2025-04-16
Title
Eventin < 4.0.26 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.26
CVSS
8.8 (high)
Published
2025-03-19
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.25 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.25
CVSS
8.8 (high)
Published
2025-03-19
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.25 - Missing Authorization to Unauthenticated Payment Status Update
Fixed in
Fixed in 4.0.25
CVSS
5.3 (medium)
Published
2025-02-23
Title
Eventin < 4.0.21 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.21
CVSS
8.8 (high)
Published
2024-12-19
Title
Eventin < 4.0.9 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.9
CVSS
8.8 (high)
Published
2024-09-26
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.9 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.9
CVSS
8.8 (high)
Published
2024-08-01
Title
Eventin < 4.0.6 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.6
CVSS
6.4 (medium)
Published
2024-07-16
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.5 - Missing Authorization to Authenticated (Contributor+) Event Data Import
Fixed in
Fixed in 4.0.5
CVSS
4.3 (medium)
Published
2024-07-04
Title
Eventin < 4.0.0 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.0
CVSS
6.4 (medium)
Published
2024-02-08
Title
Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin < 3.3.51 - Missing Authorization to Unauthenticated Events Export
Fixed in
Fixed in 3.3.51
CVSS
5.3 (medium)