Arraytics Eventin vulnerabilities

• arraytics eventin Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay CVE-2026-84906 5.3 MediumSeptember 16, 2026
• arraytics eventin Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint CVE-2026-84907 3.7 LowSeptember 16, 2026
• arraytics eventin Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation CVE-2026-84905 2.7 LowSeptember 16, 2026
• arraytics eventin Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token CVE-2026-77702 5.3 MediumSeptember 16, 2026
• arraytics eventin – event calendar, tickets, registration, booking & woocommerce Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter CVE-2026-75983 7.5 HighSeptember 15, 2026
• arraytics eventin – event calendar, tickets, registration, booking & woocommerce Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter CVE-2026-15402 6.4 MediumSeptember 15, 2026
• arraytics eventin – event calendar, tickets, registration, booking & woocommerce Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint CVE-2026-11821 5.4 MediumSeptember 9, 2026
• arraytics eventin – event calendar, tickets, registration, booking & woocommerce Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter CVE-2026-15667 7.5 HighSeptember 9, 2026
• arraytics eventin – event calendar, tickets, registration, booking & woocommerce Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter CVE-2026-15406 7.5 HighSeptember 9, 2026
• arraytics eventin – event calendar, tickets, registration, booking & woocommerce Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter CVE-2026-12956 5.3 MediumSeptember 9, 2026
• arraytics eventin Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization CVE-2026-84901 4.9 MediumSeptember 5, 2026
• arraytics eventin Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta CVE-2026-84898 6.6 MediumSeptember 5, 2026
• arraytics eventin Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token CVE-2026-77694 5.3 MediumAugust 26, 2026
• arraytics eventin Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure CVE-2026-13172 5.3 MediumAugust 26, 2026
• arraytics eventin Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery CVE-2026-13176 2.7 LowAugust 21, 2026
• arraytics eventin Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR CVE-2026-13175 6.5 MediumAugust 19, 2026
• arraytics eventin Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR CVE-2026-13174 7.2 HighAugust 19, 2026
• arraytics eventin Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation CVE-2026-13173 2.7 LowAugust 19, 2026
• arraytics eventin Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR CVE-2026-13169 8.1 HighAugust 19, 2026
• arraytics eventin Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR CVE-2026-13177 4.3 MediumAugust 12, 2026
• arraytics eventin Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint CVE-2026-13171 8.2 HighAugust 12, 2026
• arraytics eventin Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API CVE-2026-13168 6.5 MediumAugust 12, 2026
• arraytics eventin Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting CVE-2026-13170 7.2 HighAugust 10, 2026
• arraytics eventin Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation CVE-2026-13178 7.5 HighJuly 30, 2026
• arraytics eventin – event calendar, event registration, tickets & booking (ai powered) Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API CVE-2026-13039 5.3 MediumJuly 10, 2026
• arraytics eventin – event calendar, event registration, tickets & booking (ai powered) Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter CVE-2026-12924 6.4 MediumJuly 10, 2026
• arraytics eventin – event calendar, event registration, tickets & booking (ai powered) Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure CVE-2026-4109 4.3 MediumApril 14, 2026
• arraytics eventin WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability CVE-2025-68047 8.8 HighJanuary 22, 2026
• arraytics eventin – event calendar, event registration, tickets & booking (ai powered) Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' CVE-2025-14657 7.2 HighJanuary 9, 2026
• arraytics eventin – event calendar, event registration, tickets & booking (ai powered) Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery CVE-2025-7813 7.2 HighAugust 23, 2025
• arraytics eventin WordPress Eventin Plugin <= 4.0.31 - PHP Object Injection Vulnerability CVE-2025-49869 8.8 HighAugust 14, 2025
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover CVE-2025-4796 Public exploit 8.8 HighAugust 8, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) Vulnerability CVE-2025-49321 7.1 HighJune 27, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability CVE-2025-47539 Public exploit EPSS 25.4% 9.8 CriticalMay 23, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability CVE-2025-47445 Public exploit 7.5 HighMay 14, 2025
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read CVE-2025-3419 Public exploit 7.5 HighMay 8, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability CVE-2025-39584 7.5 HighApril 16, 2025
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update CVE-2025-1766 5.3 MediumMarch 20, 2025
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion CVE-2025-1770 8.8 HighMarch 20, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.20 - Local File Inclusion vulnerability CVE-2025-26964 7.5 HighFebruary 25, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability CVE-2024-56213 6.5 MediumDecember 31, 2024
• arraytics eventin WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal Vulnerability CVE-2023-49756 5.4 MediumDecember 9, 2024
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion CVE-2024-7149 8.8 HighSeptember 27, 2024
• arraytics eventin WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability CVE-2024-39648 5.9 MediumAugust 1, 2024
• arraytics eventin WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerability CVE-2024-37507 6.5 MediumJuly 21, 2024
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import CVE-2024-6033 4.3 MediumJuly 17, 2024
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export CVE-2024-1122 5.3 MediumFebruary 9, 2024