11
CVEs
0
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
8
LOW
0
Monthly CVE Trend
Affected Products (12)
Wordpress Plugin
26
Eventin Event Calendar Tickets Registration Booking Woocommerce
7
Wp Event Solution
6
Booktics
4
PHP
4
Eventin Event Calendar Event Registration Tickets Booking Ai Powered
3
Timetics
3
Wpcafe
1
Booktics Appointment Booking Calendar For Service Businesses
1
Wp Timetics
1
Wpcafe Restaurant Menu Online Food Ordering Table Booking System
1
Woocommerce
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-15406 | Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented. | HIGH | 7.5 | 0.7% | 38 |
No patch
|
| CVE-2026-15667 | Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.6% | 38 |
No patch
|
| CVE-2026-75983 | Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-82223 | Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-84215 | Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-15402 | Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-11821 | Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|
| CVE-2026-12956 | Ticket inventory exhaustion in WP Event Solution (Eventin) ≤4.1.22 allows any unauthenticated visitor to forge completed event orders and permanently lock out legitimate ticket buyers. The REST endpoint /wp-json/eventin/v2/orders relies solely on a wp_rest nonce for authorization, but that nonce is broadcast to every site visitor via the etn-public script's localized_data_obj - making the check functionally equivalent to no check at all. By submitting crafted POST requests with status='completed', attackers create persistent fake sold-order records that count against ticket inventory indefinitely, since the auto-cleanup scheduler only targets pending orders. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-11446 | Unauthorized customer data modification in the Booktics WordPress plugin allows unauthenticated remote attackers to overwrite any existing customer's stored name, phone number, and linked WordPress user ID by supplying only the target's email address in a crafted REST API request. All plugin versions through 1.0.23 by Arraytics are affected, with the root cause split between a permission callback that unconditionally returns true and a guest-update function that applies caller-supplied contact data to any record whose email matches without ownership verification. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack path makes systematic data poisoning of booking reminders, SMS notifications, and CRM integrations feasible for any attacker who can enumerate customer emails. | MEDIUM | 5.3 | 0.2% | 27 |
No patch
|
| CVE-2026-62135 | Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated remote attackers to perform restricted write operations without any authentication. The CVSS vector (PR:N, I:L) confirms the flaw allows unauthorized integrity-impacting actions - such as modifying booking data or plugin state - accessible directly over the network. No public exploit code or active exploitation has been identified at time of analysis. | MEDIUM | 5.3 | 0.2% | 26 |
No patch
|
| CVE-2026-15398 | Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository. | MEDIUM | 4.3 | 0.3% | 22 |
No patch
|