Eventin
Monthly
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. A publicly available proof-of-concept exists, and SSVC flags the attack as automatable - enabling scaled ticket fraud against any WordPress site running the affected plugin.
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. A publicly available proof-of-concept exploit exists, and the attack is fully automatable per the SSVC framework, though CISA has not listed this in KEV and the EPSS score is low (0.18%), suggesting exploitation has not yet been widespread.
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal information - to any contributor-level or higher WordPress user via an Insecure Direct Object Reference (IDOR) flaw. Authenticated users can enumerate order identifiers sequentially to read arbitrary customers' purchase data without authorization. A public proof-of-concept is available via WPScan, and an EPSS score of 14% places this notably above the median for WordPress plugin vulnerabilities, indicating active interest from threat actors even without a CISA KEV listing.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 28.9% and no vendor patch available.
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image(). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion.0.25. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion.0.20. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.0.7. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.3.52. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.0.5. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.3.57. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file'. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data(). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Unauthenticated account creation in the Eventin WordPress plugin (all versions before 4.1.20) allows any remote attacker to register arbitrary email addresses as WordPress user accounts and inject order records by exploiting a missing authorization check on the waiting-list registration handler. The dual impact - rogue account creation and order record injection - can be chained with WordPress's built-in password reset flow to achieve full account takeover for any email address on the system. With a publicly available exploit and a 15% EPSS score placing this well above the median exploitation probability, this represents an elevated and realistic risk for all WordPress sites running the unpatched plugin; no CISA KEV listing is confirmed at time of analysis.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Broken authorization in the Eventin WordPress plugin before 4.1.16 lets unauthenticated visitors create orders and supply their own order status, marking those orders as paid without ever completing payment. Because the order-creation endpoint neither authorizes the requester nor validates the payment state, remote attackers can forge fully-paid transactions, undermining ticket/event revenue integrity. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.15% and it is not listed in CISA KEV.
Missing authorization on Eventin's event-management REST routes allows low-privilege WordPress contributors to perform integrity-impacting actions outside their permitted scope. Affected installations running Eventin before 4.1.22 expose endpoints that let contributor-role users redirect the site's public front page to an arbitrary event they do not own, and create, edit, or delete global event and speaker taxonomy terms site-wide. A publicly available exploit is documented by WPScan, though SSVC exploitation status is none and EPSS is 0.13%, indicating no confirmed active abuse at time of analysis.
Local file inclusion in Eventin WordPress plugin before 4.1.21 enables authenticated contributors and higher-privileged users to include and execute arbitrary PHP files on the web server. The plugin fails to validate a user-supplied template path parameter before passing it to a PHP file-inclusion routine, allowing path traversal to any locally accessible PHP file. A publicly available proof-of-concept has been published by WPScan; vendor patch 4.1.21 is available and should be applied immediately.
Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. A publicly available proof-of-concept exists, and SSVC flags the attack as automatable - enabling scaled ticket fraud against any WordPress site running the affected plugin.
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. A publicly available proof-of-concept exploit exists, and the attack is fully automatable per the SSVC framework, though CISA has not listed this in KEV and the EPSS score is low (0.18%), suggesting exploitation has not yet been widespread.
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.
Eventin WordPress plugin versions from 4.1.9 through 4.1.19 exposes customer order records - including personal information - to any contributor-level or higher WordPress user via an Insecure Direct Object Reference (IDOR) flaw. Authenticated users can enumerate order identifiers sequentially to read arbitrary customers' purchase data without authorization. A public proof-of-concept is available via WPScan, and an EPSS score of 14% places this notably above the median for WordPress plugin vulnerabilities, indicating active interest from threat actors even without a CISA KEV listing.
Eventin WordPress plugin versions before 4.1.20 exposes stored customer records - including names and email addresses - to any authenticated WordPress user holding contributor-level access or higher, due to missing server-side capability checks on customer data retrieval. A publicly available proof-of-concept exploit exists per the WPScan advisory, and an EPSS score of 15% places exploitation probability well above the median for medium-severity CVEs. The vendor-released patch (version 4.1.20) resolves the access control gap; no active exploitation is confirmed in the CISA KEV catalog at time of analysis.
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Reflected cross-site scripting in the Eventin WordPress plugin up to version 4.0.28 allows unauthenticated attackers to inject arbitrary web scripts via crafted URLs. When a victim clicks the link while authenticated, the malicious code executes in their browser, potentially leading to session hijacking or site defacement. At the time of analysis, no public exploit or active exploitation has been identified, and the EPSS score of 0.04% indicates very low exploitation probability.
Incorrect Privilege Assignment vulnerability in Themewinter Eventin allows Privilege Escalation.0.26. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 28.9% and no vendor patch available.
Relative Path Traversal vulnerability in Themewinter Eventin allows Path Traversal.0.26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image(). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion.0.25. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion.0.20. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.0.7. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.3.52. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.0.5. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.3.57. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Event Manager, Events Calendar, Tickets, Registrations - Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file'. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The Event Manager, Events Calendar, Events Tickets for WooCommerce - Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data(). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.