VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce security & vulnerabilities

wp-event-solution— active installsLast vulnerability Nov 5, 2026

No known unpatched vulnerabilities in the latest version

All 59 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
59Known vulnerabilities
  • Critical1
  • High15
  • Medium43
  • Low0
Vulnerabilities per year
2023: 1 vulnerability1232024: 6 vulnerabilities6242025: 10 vulnerabilities10252026: 42 vulnerabilities4226

All Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce vulnerabilities

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter
≤4.1.29Update to 4.1.30
CVE-2026-109994
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.1.26Update to 4.1.27
CVE-2026-112844
Medium5.3Missing Authorization
≤4.1.26Update to 4.1.27
CVE-2026-110380
Medium5.3Missing Authorization
≤4.1.25Update to 4.1.26
CVE-2026-109898
Medium5.3Missing Authorization
≤4.1.25Update to 4.1.26
CVE-2026-97300
Medium5.3Missing Authorization
≤4.1.25Update to 4.1.26
CVE-2026-103684
Medium5.3Unauthenticated Information Exposure
≤4.1.25Update to 4.1.26
CVE-2026-105073
High7.5Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
≤4.1.23Update to 4.1.24
CVE-2026-75983
Medium6.4Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
≤4.1.23Update to 4.1.24
CVE-2026-15402
Medium4.3Missing Authorization
≤4.1.23Update to 4.1.24
CVE-2026-84905
Medium5.3Unauthenticated Payment Bypass
≤4.1.23Update to 4.1.24
CVE-2026-84906
Medium5.3Missing Authorization
≤4.1.23Update to 4.1.24
CVE-2026-77702
Medium5.3Missing Authorization
≤4.1.23Update to 4.1.24
CVE-2026-84907
Medium5.4Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint
≤4.1.17Update to 4.1.18
CVE-2026-11821
High7.5Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
≤4.1.22Update to 4.1.23
CVE-2026-15667
High7.5Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
≤4.1.22Update to 4.1.23
CVE-2026-15406
Medium5.3Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter
≤4.1.22Update to 4.1.23
CVE-2026-12956
Medium4.3Missing Authorization
<4.1.22Update to 4.1.22
CVE-2026-84901
Medium6.5Authenticated (Contributor+) Path Traversal
<4.1.21Update to 4.1.21
CVE-2026-84898
Medium5.3Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption
≤4.1.22Update to 4.1.23
CVE-2026-82223
Medium5.3Unauthenticated Information Exposure
<4.1.22Update to 4.1.22
CVE-2026-13172
Medium5.3Unauthenticated Order Completion
<4.1.19Update to 4.1.19
CVE-2026-77694
Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
<4.1.21Update to 4.1.21
CVE-2026-13176
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion
≤4.1.20Update to 4.1.21
CVE-2026-13174
Medium4.3Missing Authorization
≤4.1.20Update to 4.1.21
CVE-2026-13173
Medium6.3Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification
≤4.1.20Update to 4.1.21
CVE-2026-13175
Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover
≤4.1.20Update to 4.1.21
CVE-2026-13169
Medium4.3Authenticated (Contributor+) Information Exposure
<4.1.20Update to 4.1.20
CVE-2026-13168
Medium4.3Authenticated (Customer+) Information Exposure
≤4.1.18Update to 4.1.19
CVE-2026-28174
Medium4.3Authenticated (Customer+) Arbitrary Content Deletion
≤4.1.19Update to 4.1.20
CVE-2026-28173
Medium4.3Authenticated (Contributor+) Information Exposure
<4.1.20Update to 4.1.20
CVE-2026-13177
Medium5.3Unauthenticated User Account Creation
<4.1.20Update to 4.1.20
CVE-2026-13171
Medium6.6Authenticated (Editor+) Local File Inclusion
≤4.1.19Update to 4.1.20
CVE-2026-13170
Medium5.3Missing Authorization
≤4.1.9Update to 4.1.10
CVE-2026-66451
Medium5.3Unauthenticated Payment Bypass
<4.1.16Update to 4.1.16
CVE-2026-13178
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter
≤4.1.15Update to 4.1.16
CVE-2026-12924
Medium5.34.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API
4.0.26 – 4.1.15Update to 4.1.16
CVE-2026-13039
Medium5.3Missing Authorization
≤4.1.12Update to 4.1.13
CVE-2025-68045
Medium5.3Missing Authorization
≤4.1.8Update to 4.1.9
CVE-2026-40776
Medium4.3Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
≤4.1.8Update to 4.1.9
CVE-2026-4109
High7.5Authenticated (Contributor+) PHP Object Injection
≤4.1.3Update to 4.1.4
CVE-2025-68047
High7.2Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'
≤4.0.51Update to 4.0.52
CVE-2025-14657
High7.2Unauthenticated Server-Side Request Forgery
≤4.0.37Update to 4.0.38
CVE-2025-7813
High7.5Authenticated (Contributor+) PHP Object Injection
≤4.0.31Update to 4.0.32
CVE-2025-49869
High8.8Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover
≤4.0.34Update to 4.0.35
CVE-2025-4796
Medium6.1Reflected Cross-Site Scripting
≤4.0.28Update to 4.0.29
CVE-2025-49321
High7.5Unauthenticated Arbitrary File Read
≤4.0.26Update to 4.0.27
CVE-2025-3419
Critical9.8Missing Authorization to Unauthenticated Privilege Escalation
≤4.0.26Update to 4.0.27
CVE-2025-47539
High8.8Authenticated (Contributor+) Local File Inclusion
≤4.0.25Update to 4.0.26
CVE-2025-39584
High8.8Authenticated (Contributor+) Local File Inclusion
≤4.0.24Update to 4.0.25
CVE-2025-1770
Medium5.3Missing Authorization to Unauthenticated Payment Status Update
≤4.0.24Update to 4.0.25
CVE-2025-1766
High8.8Authenticated (Contributor+) Local File Inclusion
≤4.0.20Update to 4.0.21
CVE-2025-26964
High8.8Authenticated (Contributor+) Local File Inclusion
≤4.0.7Update to 4.0.9
CVE-2024-56213
High8.8Authenticated (Contributor+) Local File Inclusion
≤4.0.8Update to 4.0.9
CVE-2024-7149
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤4.0.5Update to 4.0.6
CVE-2024-39648
Medium4.3Missing Authorization to Authenticated (Contributor+) Event Data Import
≤4.0.4Update to 4.0.5
CVE-2024-6033
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤3.3.57Update to 4.0.0
CVE-2024-37507
Medium5.3Missing Authorization to Unauthenticated Events Export
≤3.3.50Update to 3.3.51
CVE-2024-1122
Medium4.3Missing Authorization
≤3.3.52Update to 3.3.53
CVE-2023-49756

Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce: common questions

Does Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce have known vulnerabilities?

Yes. VulnCrest Radar lists 59 known vulnerabilities in Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce: 1 critical, 15 high, 43 medium. None are known to affect version null.

How do I check which version of Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce vulnerability?

CVE-2026-109994, published Nov 5, 2026: Eventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter. Severity: Medium (CVSS 6.5).

Is any Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce vulnerability listed in CISA KEV?

No. None of the known Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?