arraytics Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) vulnerabilities

23 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your arraytics Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) version is affected

Latest arraytics Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) vulnerabilities

CVE-2026-13039 — Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API (CVSS 5.3)
CVE-2026-12924 — Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter (CVSS 6.4)
CVE-2026-4109 — Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure (CVSS 4.3)
CVE-2025-68047 — WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability (CVSS 8.8)
CVE-2025-14657 — Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' (CVSS 7.2)
CVE-2025-7813 — Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery (CVSS 7.2)
CVE-2025-49869 — WordPress Eventin Plugin <= 4.0.31 - PHP Object Injection Vulnerability (CVSS 8.8)
CVE-2025-4796 — Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover (CVSS 8.8)
CVE-2025-49321 — WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.1)
CVE-2025-47539 — WordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability (CVSS 9.8)
CVE-2025-47445 — WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability (CVSS 9.8)
CVE-2025-3419 — Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read (CVSS 7.5)
CVE-2025-39584 — WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability (CVSS 7.5)
CVE-2025-1770 — Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8)
CVE-2025-1766 — Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update (CVSS 5.3)
CVE-2025-26964 — WordPress Eventin plugin <= 4.0.20 - Local File Inclusion vulnerability (CVSS 8.8)
CVE-2024-56213 — WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability (CVSS 8.8)
CVE-2023-49756 — WordPress Eventin plugin <= 3.3.52 - Authenticated Notice Dismissal Vulnerability (CVSS 8.8)
CVE-2024-7149 — Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8)
CVE-2024-39648 — WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
CVE-2024-37507 — WordPress Eventin plugin <= 3.3.57 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-6033 — Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import (CVSS 4.3)
CVE-2024-1122 — Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export (CVSS 5.3)