Themewinter Eventin vulnerabilities

• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover CVE-2025-4796 Public exploit 8.8 HighAugust 8, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) Vulnerability CVE-2025-49321 7.1 HighJune 27, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability CVE-2025-47539 Public exploit EPSS 25.4% 9.8 CriticalMay 23, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability CVE-2025-47445 Public exploit 7.5 HighMay 14, 2025
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read CVE-2025-3419 Public exploit 7.5 HighMay 8, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability CVE-2025-39584 7.5 HighApril 16, 2025
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update CVE-2025-1766 5.3 MediumMarch 20, 2025
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion CVE-2025-1770 8.8 HighMarch 20, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.20 - Local File Inclusion vulnerability CVE-2025-26964 7.5 HighFebruary 25, 2025
• arraytics eventin WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability CVE-2024-56213 6.5 MediumDecember 31, 2024
• arraytics eventin WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal Vulnerability CVE-2023-49756 5.4 MediumDecember 9, 2024
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion CVE-2024-7149 8.8 HighSeptember 27, 2024
• arraytics eventin WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability CVE-2024-39648 5.9 MediumAugust 1, 2024
• arraytics eventin WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerability CVE-2024-37507 6.5 MediumJuly 21, 2024
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import CVE-2024-6033 4.3 MediumJuly 17, 2024
• themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 more Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export CVE-2024-1122 5.3 MediumFebruary 9, 2024