Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

Information

Software Type Plugin
Software Slug wp-event-solution (view on wordpress.org)
Software Status Active
Software Author arraytics
Software Website themewinter.com
Software Downloads 845,586
Software Active Installs 10,000
Software Record Last Updated July 21, 2026

Showing 1-20 of 24 Vulnerabilities

Submit a Vulnerability
Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
6.4
CVE-2026-12924
Jul 9, 2026
Researcher: PRISM
Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
5.3
CVE-2026-13039
Jul 9, 2026
Researcher: Niv Kochan
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization
5.3
CVE-2025-68045
Jun 15, 2026
Researcher: l3m3s
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization
5.3
CVE-2026-40776
Apr 29, 2026
Researcher: Lorenzo Fradeani
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
4.3
CVE-2026-4109
Apr 13, 2026
Researcher: Supakiad S. (m3ez)
Eventin <= 4.1.3 - Authenticated (Contributor+) PHP Object Injection
7.5
CVE-2025-68047
Jan 22, 2026
Researcher: w41bu1
Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'
7.2
CVE-2025-14657
Jan 8, 2026
Researcher: Sarawut Poolkhet (MisterHelloz)
Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery
7.2
CVE-2025-7813
Aug 22, 2025
Researcher: Gai Tanaka (63n0)
Eventin <= 4.0.31 - Authenticated (Contributor+) PHP Object Injection
7.5
CVE-2025-49869
Aug 13, 2025
Researcher: Nguyen Ngoc Quang Bach (maysbachs)
Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
8.8
CVE-2025-4796
Aug 8, 2025
Researcher: István Márton
Eventin <= 4.0.28 - Reflected Cross-Site Scripting
6.1
CVE-2025-49321
Jun 23, 2025
Researcher: Nguyen Ngoc Quang Bach (maysbachs)
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read
7.5
CVE-2025-3419
May 7, 2025
Researcher: mikemyers
Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation
9.8
CVE-2025-47539
May 7, 2025
Researcher: Denver Jackson
Eventin <= 4.0.25 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-39584
Apr 16, 2025
Researcher: theviper17y
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-1770
Mar 19, 2025
Researcher: wesley (wcraft)
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
5.3
CVE-2025-1766
Mar 19, 2025
Researcher: wesley (wcraft)
Eventin <= 4.0.20 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-26964
Feb 23, 2025
Researcher: Peter Thaleikis
Eventin <= 4.0.7 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2024-56213
Dec 19, 2024
Researcher: João Pedro Soares de Alcântara
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2024-7149
Sep 26, 2024
Researcher: stealthcopter
Eventin <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting
6.4
CVE-2024-39648
Aug 1, 2024
Researcher: akas wisnu aji
Title Status CVE ID CVSS Researchers Date
Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter Patched CVE-2026-12924 6.4 PRISM July 9, 2026
Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API Patched CVE-2026-13039 5.3 Niv Kochan July 9, 2026
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization Patched CVE-2025-68045 5.3 l3m3s June 15, 2026
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization Patched CVE-2026-40776 5.3 Lorenzo Fradeani April 29, 2026
Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure Patched CVE-2026-4109 4.3 Supakiad S. (m3ez) April 13, 2026
Eventin <= 4.1.3 - Authenticated (Contributor+) PHP Object Injection Patched CVE-2025-68047 7.5 w41bu1 January 22, 2026
Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' Patched CVE-2025-14657 7.2 Sarawut Poolkhet (MisterHelloz) January 8, 2026
Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery Patched CVE-2025-7813 7.2 Gai Tanaka (63n0) August 22, 2025
Eventin <= 4.0.31 - Authenticated (Contributor+) PHP Object Injection Patched CVE-2025-49869 7.5 Nguyen Ngoc Quang Bach (maysbachs) August 13, 2025
Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover Patched CVE-2025-4796 8.8 István Márton August 8, 2025
Eventin <= 4.0.28 - Reflected Cross-Site Scripting Patched CVE-2025-49321 6.1 Nguyen Ngoc Quang Bach (maysbachs) June 23, 2025
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read Patched CVE-2025-3419 7.5 mikemyers May 7, 2025
Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation Patched CVE-2025-47539 9.8 Denver Jackson May 7, 2025
Eventin <= 4.0.25 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2025-39584 8.8 theviper17y April 16, 2025
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2025-1770 8.8 wesley (wcraft) March 19, 2025
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update Patched CVE-2025-1766 5.3 wesley (wcraft) March 19, 2025
Eventin <= 4.0.20 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2025-26964 8.8 Peter Thaleikis February 23, 2025
Eventin <= 4.0.7 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2024-56213 8.8 João Pedro Soares de Alcântara December 19, 2024
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2024-7149 8.8 stealthcopter September 26, 2024
Eventin <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting Patched CVE-2024-39648 6.4 akas wisnu aji August 1, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation