Plugin icon

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

wp-event-solution

Vulnerabilities:

46

Last Updated:

September 10, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-09-08
Title
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) < 4.1.23 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
Fixed in
Fixed in 4.1.23
CVSS
4.3 (medium)
Published
2026-09-08
Title
Eventin < 4.1.18 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
Fixed in
Fixed in 4.1.18
CVSS
5.4 (medium)
Published
2026-09-08
Title
Eventin < 4.1.23 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
Fixed in
Fixed in 4.1.23
CVSS
7.5 (high)
Published
2026-09-08
Title
Eventin < 4.1.23 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
Fixed in
Fixed in 4.1.23
CVSS
7.5 (high)
Published
2026-09-08
Title
Eventin < 4.1.23 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
Fixed in
Fixed in 4.1.23
CVSS
5.3 (medium)
Published
2026-09-03
Title
Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
Fixed in
Fixed in 4.1.21
CVSS
6.6 (medium)
Published
2026-09-03
Title
Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
Fixed in
Fixed in 4.1.22
CVSS
4.9 (medium)
Published
2026-09-01
Title
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.23 - Missing Authorization
Fixed in
Fixed in 4.1.23
CVSS
5.3 (medium)
Published
2026-08-24
Title
Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token
Fixed in
Fixed in 4.1.19
CVSS
5.3 (medium)
Published
2026-08-24
Title
Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure
Fixed in
Fixed in 4.1.22
CVSS
5.3 (medium)
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation
Fixed in
Fixed in 4.1.21
CVSS
2.7 (low)
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR
Fixed in
Fixed in 4.1.21
CVSS
6.5 (medium)
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
Fixed in
Fixed in 4.1.21
CVSS
6.5 (medium)
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
Fixed in
Fixed in 4.1.21
CVSS
2.7 (low)
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
Fixed in
Fixed in 4.1.21
CVSS
6.5 (medium)
Published
2026-08-13
Title
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Customer+) Arbitrary Content Deletion
Fixed in
Fixed in 4.1.20
CVSS
4.3 (medium)
Published
2026-08-13
Title
Event SOlution < 4.1.19 - Authenticated (Customer+) Information Exposure
Fixed in
Fixed in 4.1.19
CVSS
4.3 (medium)
Published
2026-08-10
Title
Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR
Fixed in
Fixed in 4.1.20
CVSS
2.7 (low)
Published
2026-08-10
Title
Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint
Fixed in
Fixed in 4.1.20
CVSS
5.3 (medium)
Published
2026-08-10
Title
Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API
Fixed in
Fixed in 4.1.20
CVSS
2.7 (low)
Published
2026-08-06
Title
Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting
Fixed in
Fixed in 4.1.20
CVSS
7.2 (medium)
Published
2026-08-05
Title
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.10 - Missing Authorization
Fixed in
Fixed in 4.1.10
CVSS
5.3 (medium)
Published
2026-07-13
Title
Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
Fixed in
Fixed in 4.1.16
CVSS
n/a
Published
2026-07-09
Title
Eventin < 4.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
Fixed in
Fixed in 4.1.16
CVSS
5.5 (medium)
Published
2026-07-09
Title
Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
Fixed in
Fixed in 4.1.16
CVSS
5.3 (medium)
Published
2026-06-15
Title
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) < 4.1.13 - Missing Authorization
Fixed in
Fixed in 4.1.13
CVSS
5.3 (medium)
Published
2026-04-29
Title
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) < 4.1.9 - Missing Authorization
Fixed in
Fixed in 4.1.9
CVSS
5.3 (medium)
Published
2026-04-13
Title
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) < 4.1.9 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Fixed in
Fixed in 4.1.9
CVSS
4.3 (medium)
Published
2026-01-22
Title
Eventin < 4.1.4 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 4.1.4
CVSS
7.5 (high)
Published
2026-01-08
Title
Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) < 4.0.52 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'
Fixed in
Fixed in 4.0.52
CVSS
7.2 (high)
Published
2025-08-22
Title
Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin < 4.0.38 - Unauthenticated Server-Side Request Forgery
Fixed in
Fixed in 4.0.38
CVSS
7.2 (high)
Published
2025-08-13
Title
Eventin < 4.0.32 - Authenticated (Contributor+) PHP Object Injection
Fixed in
Fixed in 4.0.32
CVSS
7.5 (high)
Published
2025-08-08
Title
Eventin < 4.0.35 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
Fixed in
Fixed in 4.0.35
CVSS
8.8 (high)
Published
2025-06-23
Title
Eventin < 4.0.29 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.0.29
CVSS
6.1 (medium)
Published
2025-05-07
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.27 - Unauthenticated Arbitrary File Read
Fixed in
Fixed in 4.0.27
CVSS
7.5 (high)
Published
2025-05-07
Title
Eventin < 4.0.27 - Missing Authorization to Unauthenticated Privilege Escalation
Fixed in
Fixed in 4.0.27
CVSS
9.8 (critical)
Published
2025-04-16
Title
Eventin < 4.0.26 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.26
CVSS
8.8 (high)
Published
2025-03-19
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.25 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.25
CVSS
8.8 (high)
Published
2025-03-19
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.25 - Missing Authorization to Unauthenticated Payment Status Update
Fixed in
Fixed in 4.0.25
CVSS
5.3 (medium)
Published
2025-02-23
Title
Eventin < 4.0.21 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.21
CVSS
8.8 (high)
Published
2024-12-19
Title
Eventin < 4.0.9 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.9
CVSS
8.8 (high)
Published
2024-09-26
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.9 - Authenticated (Contributor+) Local File Inclusion
Fixed in
Fixed in 4.0.9
CVSS
8.8 (high)
Published
2024-08-01
Title
Eventin < 4.0.6 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.6
CVSS
6.4 (medium)
Published
2024-07-16
Title
Event Manager, Events Calendar, Tickets, Registrations – Eventin < 4.0.5 - Missing Authorization to Authenticated (Contributor+) Event Data Import
Fixed in
Fixed in 4.0.5
CVSS
4.3 (medium)
Published
2024-07-04
Title
Eventin < 4.0.0 - Authenticated (Author+) Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.0
CVSS
6.4 (medium)
Published
2024-02-08
Title
Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin < 3.3.51 - Missing Authorization to Unauthenticated Events Export
Fixed in
Fixed in 3.3.51
CVSS
5.3 (medium)