Themewinter - vulnerabilities (CVEs)

23 CVEs in 3 products, 0 in the last 30 days, newest from 2026-08-20.

Products

• Eventin - 16 CVEs
• Wpcafe - 6 CVEs
• Wp Cafe Pro - 1 CVEs

Newest CVEs of Themewinter

• CVE-2026-66586 - CVSS 6.6 (medium), 2026-08-20: Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
• CVE-2025-4796 - CVSS 8.8 (high), 2025-08-08: The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the…
• CVE-2025-49321 - CVSS 7.1 (high), 2025-06-27: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Eventin wp-event-solution allows Reflected…
• CVE-2025-47539 - CVSS 9.8 (critical), 2025-05-23: Incorrect Privilege Assignment vulnerability in Arraytics Eventin wp-event-solution allows Privilege Escalation.This issue affects Eventin: from n/a through…
• CVE-2025-47445 - CVSS 9.8 (critical), 2025-05-14: Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.
• CVE-2025-3419 - CVSS 7.5 (high), 2025-05-08: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and…
• CVE-2025-39584 - CVSS 7.5 (high), 2025-04-16: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution…
• CVE-2025-1770 - CVSS 8.8 (high), 2025-03-20: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and…
• CVE-2025-1766 - CVSS 5.3 (medium), 2025-03-20: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing…
• CVE-2025-26964 - CVSS 8.8 (high), 2025-02-25: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution…
• CVE-2024-56213 - CVSS 8.8 (high), 2024-12-31: Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7.
• CVE-2023-49756 - CVSS 8.8 (high), 2024-12-09: Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…
• CVE-2023-47805 - CVSS 9.8 (critical), 2024-12-09: Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…
• CVE-2024-7149 - CVSS 8.8 (high), 2024-09-27: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and…
• CVE-2024-43135 - CVSS 8.8 (high), 2024-08-13: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows PHP Local File Inclusion.This issue…
• CVE-2024-39648 - CVSS 5.9 (medium), 2024-08-01: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue…
• CVE-2024-37507 - CVSS 6.5 (medium), 2024-07-21: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue…
• CVE-2024-6033 - CVSS 4.3 (medium), 2024-07-17: The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing…
• CVE-2024-37513 - CVSS 8.8 (high), 2024-07-09: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects…
• CVE-2024-5431 - CVSS 8.8 (high), 2024-06-25: The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in…
• CVE-2024-5427 - CVSS 6.4 (medium), 2024-05-31: The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site…
• CVE-2024-1855 - CVSS 5.3 (medium), 2024-05-23: The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side…
• CVE-2024-1122 - CVSS 5.3 (medium), 2024-02-09: The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a…