Wp Event Solution
Monthly
Stored cross-site scripting in the WP Event Solution WordPress plugin, affecting versions through 4.1.26, lets an actor who can store input that the plugin later renders execute script in the browser of a user who views the affected page. The CVSS vector requires victim interaction (UI:R) and indicates a scope change (S:C), and the supplied vector lists PR:N although the specific field and capability required are not described in the available sources; if authenticated submission is in fact required, exploitation is more limited. This is a moderate, not emergency, priority (vuln.today decision: this_week), and no public exploit was identified at time of analysis.
WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated information disclosure in the Arraytics WP Event Solution (Eventin) WordPress plugin through version 4.1.8 allows remote attackers to bypass access control checks and read data they should not be permitted to access. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36985; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (versions through 4.1.26) allows unauthenticated remote attackers to bypass access controls and modify plugin-controlled data, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (low integrity impact only, no confidentiality or availability loss). This moderate-severity CWE-862 flaw requires only that the vulnerable plugin be installed and network-reachable on a WordPress site; no authentication or user interaction is needed. At time of analysis, no public exploit identified and the issue is not listed in CISA KEV.
Missing authorization in Arraytics WP Event Solution versions through 4.1.25 allows remote, unauthenticated attackers to make limited unauthorized changes under the plugin's default installation, as reflected by the integrity-only CVSS 5.3 score. The target site must have the vulnerable plugin installed and activated, and no user interaction is required; there is no KEV confirmation or public exploit code identified in the provided data. This is a moderate-to-low priority access-control flaw (CWE-862) rather than a confidentiality or availability compromise.
Unauthenticated broken access control in the WP Event Solution (Eventin) WordPress plugin, versions 4.1.25 and earlier, allows any remote, network-reachable attacker to reach functionality that should require authorization, with the realistic outcome bounded to low-severity exposure or manipulation of event-related data rather than full site compromise. The flaw carries a vendor-style CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N), and our independent reassessment scopes the impact to low confidentiality only, with no authentication, user interaction, or non-default configuration required. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code has been identified at time of analysis; the only public reporting is the Patchstack advisory, and the specific vulnerable endpoint is not disclosed, which limits operators' ability to target blocking rules precisely.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows remote attackers to invoke functionality that should be restricted to privileged users, with the CVSS vector AV:N/AC:L/PR:N/UI:N indicating no authentication, no user interaction, and no non-default configuration are needed against a site that has the plugin installed and active. Impact is limited to integrity (C:N/I:L/A:N), so affected installations face unauthorized modification or creation of plugin-managed content rather than data disclosure or denial of service. The issue is rated moderate (CVSS 5.3) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive information disclosure in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows any remote attacker to retrieve embedded sensitive data from the plugin's exposed endpoint. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation requires no credentials, no user interaction, and no non-default configuration - only that the plugin is installed and active and the affected endpoint is network-reachable. Impact is limited to partial confidentiality loss (C:L, CVSS 5.3) with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the Arraytics WP Event Solution WordPress plugin through version 4.1.12 allows remote unauthenticated attackers to access protected functionality or data without authorization. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, exposing sensitive event-management capabilities or data to anyone who can reach the WordPress site. No public exploit identified at time of analysis, and the issue is not currently listed in the CISA KEV catalog.
Stored cross-site scripting in the WP Event Solution WordPress plugin, affecting versions through 4.1.26, lets an actor who can store input that the plugin later renders execute script in the browser of a user who views the affected page. The CVSS vector requires victim interaction (UI:R) and indicates a scope change (S:C), and the supplied vector lists PR:N although the specific field and capability required are not described in the available sources; if authenticated submission is in fact required, exploitation is more limited. This is a moderate, not emergency, priority (vuln.today decision: this_week), and no public exploit was identified at time of analysis.
WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Unauthenticated information disclosure in the Arraytics WP Event Solution (Eventin) WordPress plugin through version 4.1.8 allows remote attackers to bypass access control checks and read data they should not be permitted to access. The flaw was disclosed by Patchstack and tracked as EUVD-2026-36985; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (versions through 4.1.26) allows unauthenticated remote attackers to bypass access controls and modify plugin-controlled data, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (low integrity impact only, no confidentiality or availability loss). This moderate-severity CWE-862 flaw requires only that the vulnerable plugin be installed and network-reachable on a WordPress site; no authentication or user interaction is needed. At time of analysis, no public exploit identified and the issue is not listed in CISA KEV.
Missing authorization in Arraytics WP Event Solution versions through 4.1.25 allows remote, unauthenticated attackers to make limited unauthorized changes under the plugin's default installation, as reflected by the integrity-only CVSS 5.3 score. The target site must have the vulnerable plugin installed and activated, and no user interaction is required; there is no KEV confirmation or public exploit code identified in the provided data. This is a moderate-to-low priority access-control flaw (CWE-862) rather than a confidentiality or availability compromise.
Unauthenticated broken access control in the WP Event Solution (Eventin) WordPress plugin, versions 4.1.25 and earlier, allows any remote, network-reachable attacker to reach functionality that should require authorization, with the realistic outcome bounded to low-severity exposure or manipulation of event-related data rather than full site compromise. The flaw carries a vendor-style CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N), and our independent reassessment scopes the impact to low confidentiality only, with no authentication, user interaction, or non-default configuration required. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code has been identified at time of analysis; the only public reporting is the Patchstack advisory, and the specific vulnerable endpoint is not disclosed, which limits operators' ability to target blocking rules precisely.
Missing authorization in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows remote attackers to invoke functionality that should be restricted to privileged users, with the CVSS vector AV:N/AC:L/PR:N/UI:N indicating no authentication, no user interaction, and no non-default configuration are needed against a site that has the plugin installed and active. Impact is limited to integrity (C:N/I:L/A:N), so affected installations face unauthorized modification or creation of plugin-managed content rather than data disclosure or denial of service. The issue is rated moderate (CVSS 5.3) and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive information disclosure in the Arraytics WP Event Solution WordPress plugin (all versions through 4.1.25) allows any remote attacker to retrieve embedded sensitive data from the plugin's exposed endpoint. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, exploitation requires no credentials, no user interaction, and no non-default configuration - only that the plugin is installed and active and the affected endpoint is network-reachable. Impact is limited to partial confidentiality loss (C:L, CVSS 5.3) with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations.
Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin.
Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the Arraytics WP Event Solution WordPress plugin through version 4.1.12 allows remote unauthenticated attackers to access protected functionality or data without authorization. The flaw stems from missing authorization checks (CWE-862) on plugin endpoints, exposing sensitive event-management capabilities or data to anyone who can reach the WordPress site. No public exploit identified at time of analysis, and the issue is not currently listed in the CISA KEV catalog.