20
CVEs
1
Critical
6
High
0
KEV
0
PoC
7
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
6
MEDIUM
13
LOW
0
Monthly CVE Trend
Affected Products (12)
Wordpress Plugin
26
Eventin Event Calendar Tickets Registration Booking Woocommerce
7
Wp Event Solution
6
Booktics
4
PHP
4
Eventin Event Calendar Event Registration Tickets Booking Ai Powered
3
Timetics
3
Wpcafe
1
Booktics Appointment Booking Calendar For Service Businesses
1
Wp Timetics
1
Wpcafe Restaurant Menu Online Food Ordering Table Booking System
1
Woocommerce
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-57621 | Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and including 1.0.21, letting remote attackers with no authentication inject arbitrary PHP objects into the application. If a suitable POP (property-oriented programming) gadget chain exists in the plugin, WordPress core, or another active plugin, this can escalate to remote code execution, data theft, or full site takeover. Reported by Patchstack and rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-28002 | Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version. | HIGH | 8.5 | 0.3% | 43 |
No patch
|
| CVE-2026-15406 | Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented. | HIGH | 7.5 | 0.7% | 38 |
No patch
|
| CVE-2026-15667 | Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 7.5 | 0.6% | 38 |
No patch
|
| CVE-2026-75983 | Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis. | HIGH | 7.5 | 0.4% | 38 |
No patch
|
| CVE-2026-28173 | WP Event Solution WordPress plugin versions up to and including 4.1.19 allows authenticated users with customer-level privileges to delete arbitrary content due to missing authorization controls (CWE-862). The vulnerability is network-exploitable with low privilege requirements and no user interaction, yielding high availability impact through unrestricted content deletion. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57674 | Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was provided. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-28174 | Sensitive customer data exposure in the WP Event Solution WordPress plugin (versions up to and including 4.1.18) allows authenticated low-privileged users to access confidential customer information over the network. The vulnerability, classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), results in high confidentiality impact with no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate realistic risk for sites collecting customer data via this plugin. | MEDIUM | 6.5 | 0.3% | 33 |
No patch
|
| CVE-2026-66451 | Broken authentication in WP Event Solution WordPress plugin (versions ≤4.1.9) permits unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited information disclosure and partial integrity impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no credentials and no user interaction required against any WordPress installation running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-82223 | Broken access control in WP Event Solution WordPress plugin (versions <= 4.1.22) exposes unauthenticated network attackers to unauthorized actions against event management functionality, resulting in partial integrity and availability impact. The CVSS vector (PR:N/UI:N/AC:L) confirms this is trivially exploitable by any internet-reachable attacker with no authentication or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low barrier to exploitation warrants prompt patching on public-facing WordPress installations. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-84215 | Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-15402 | Stored Cross-Site Scripting in the Eventin WordPress plugin (all versions up to and including 4.1.23) allows contributor-level authenticated attackers to inject persistent arbitrary JavaScript via the `etn_shedule_objective` field within the schedule_slot REST API parameter. The injected payload executes in the browsers of any user who subsequently views an affected event schedule page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-12924 | Stored cross-site scripting in the Eventin WordPress event management plugin (all versions through 4.1.15) lets any contributor-level user permanently embed malicious JavaScript in event FAQ sections via the unescaped `etn_faq_content` parameter. The CVSS scope change (S:C) confirms the impact crosses the attacker's security context - injected scripts execute in any visitor's browser who loads the affected event page, enabling session hijacking or credential harvesting of higher-privileged users including site administrators. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity and commonly granted contributor role make this a credible insider-threat risk on multi-user WordPress installations. | MEDIUM | 6.4 | 0.2% | 32 |
No patch
|
| CVE-2026-11818 | Authorization bypass in the WPCafe WordPress plugin (all versions through 3.0.14) allows any authenticated subscriber-level user to fully manage email notification flow workflows that are intended to be administrator-only. The FlowAPI REST endpoints bundled within the plugin's email notification SDK rely solely on a wp_rest nonce for access control - a token freely obtainable from the frontend page source by any logged-in user - completely bypassing role-based authorization. No public exploit or active exploitation has been identified at time of analysis, though the low exploitation complexity makes this a realistic risk on sites with open user registration. | MEDIUM | 5.4 | 0.3% | 27 |
No patch
|
| CVE-2026-11821 | Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw. | MEDIUM | 5.4 | 0.2% | 27 |
No patch
|