Eventin (Unknown) - vulnerabilities (CVEs)
18 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-16. Vendor: Unknown.
CVEs of Eventin
- CVE-2026-84906 - CVSS 5.3 (medium), 2026-09-16: The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the…
- CVE-2026-84907 - CVSS 3.7 (low), 2026-09-16: The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a…
- CVE-2026-84905 - CVSS 2.7 (low), 2026-09-16: The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level…
- CVE-2026-77702 - CVSS 5.3 (medium), 2026-09-16: The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards,…
- CVE-2026-84901 - CVSS 4.9 (medium), 2026-09-05: The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with…
- CVE-2026-84898 - CVSS 6.6 (medium), 2026-09-05: The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with…
- CVE-2026-77694 - CVSS 5.3 (medium), 2026-08-26: The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing…
- CVE-2026-13172 - CVSS 5.3 (medium), 2026-08-26: The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces,…
- CVE-2026-13176 - CVSS 2.7 (low), 2026-08-21: The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with…
- CVE-2026-13174 - CVSS 7.2 (high), 2026-08-19: The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access…
- CVE-2026-13173 - CVSS 2.7 (low), 2026-08-19: The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata…
- CVE-2026-13169 - CVSS 8.1 (high), 2026-08-19: The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a…
- CVE-2026-13175 - CVSS 6.5 (medium), 2026-08-19: The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with…
- CVE-2026-13177 - CVSS 4.3 (medium), 2026-08-12: The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and…
- CVE-2026-13171 - CVSS 8.2 (high), 2026-08-12: The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to…
- CVE-2026-13168 - CVSS 6.5 (medium), 2026-08-12: The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and…
- CVE-2026-13170 - CVSS 7.2 (high), 2026-08-10: The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with…
- CVE-2026-13178 - CVSS 7.5 (high), 2026-07-30: The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated…
