WordPress plugin · wp-event-solution
Is Eventin safe?
Safe on 4.1.29 or newer.
The current version, 4.1.29, is past every affected range on record (58 of 58 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 58
- High or critical
- 25
- Exploited
- none
- Current version
- 4.1.29
- Last updated
- Oct 29, 2026
- Active installs
- 10,000+
Every recorded flaw
- Oct 24, 2026WP Event Solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-112844 · affects up to 4.1.26 · reported by PatchstackHigh 7.1
- Oct 16, 2026WP Event Solution: Missing AuthorizationCVE-2026-110380 · affects up to 4.1.26 · reported by PatchstackMedium 5.3
- Oct 13, 2026WP Event Solution: Missing AuthorizationCVE-2026-109898 · affects up to 4.1.25 · reported by PatchstackMedium 5.3
- Oct 6, 2026Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.CVE-2026-97300 · affects up to 4.1.25 · reported by PatchstackMedium 6.5
- Oct 5, 2026WP Event Solution: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-105073 · affects up to 4.1.25 · reported by PatchstackMedium 5.3
- Oct 5, 2026WP Event Solution: Missing AuthorizationCVE-2026-103684 · affects up to 4.1.25 · reported by PatchstackMedium 5.3
- Sep 16, 2026Eventin: Does not verify that a completed payment corresponds to the order it is applied toCVE-2026-84906 · fixed in 4.1.24 · reported by WPScanMedium 5.3
- Sep 16, 2026Eventin: Does not properly authorise order finalisationCVE-2026-84907 · fixed in 4.1.24 · reported by WPScanLow 3.7
- Sep 16, 2026Eventin: Does not verify a user's capability to create accountsCVE-2026-84905 · fixed in 4.1.24 · reported by WPScanLow 2.7
- Sep 16, 2026Eventin: Does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwardsCVE-2026-77702 · fixed in 4.1.24 · reported by WPScanMedium 5.3
- Sep 15, 2026Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce: Privilege EscalationCVE-2026-75983 · affects up to 4.1.23 · reported by WordfenceHigh 7.5
- Sep 15, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Stored Cross-Site ScriptingCVE-2026-15402 · affects up to 4.1.23 · reported by WordfenceMedium 6.4
- Sep 9, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-11821 · affects up to 4.1.17 · reported by WordfenceMedium 5.4
- Sep 8, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Local File InclusionCVE-2026-15667 · affects up to 4.1.22 · reported by WordfenceHigh 7.5
- Sep 8, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Local File InclusionCVE-2026-15406 · affects up to 4.1.22 · reported by Wordfence1.1% oddsHigh 7.5
- Sep 8, 2026WP Event Solution (Eventin): Missing AuthorizationCVE-2026-12956 · affects up to 4.1.22 · reported by WordfenceMedium 5.3
- Sep 5, 2026Eventin: Does not properly check authorization on several of its event-management REST routesCVE-2026-84901 · fixed in 4.1.22 · reported by WPScanMedium 4.9
- Sep 5, 2026Eventin: Does not properly validate a template path value before using it to include a local fileCVE-2026-84898 · fixed in 4.1.21 · reported by WPScanMedium 6.6
- Sep 2, 2026Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.CVE-2026-82223 · affects up to 4.1.22 · reported by PatchstackMedium 6.5
- Aug 26, 2026Eventin: Does not properly restrictCVE-2026-77694 · fixed in 4.1.19 · reported by WPScanMedium 5.3
- Aug 26, 2026Eventin: Does not restrict access to non-published content by status or ownership in one of its REST API namespacesCVE-2026-13172 · fixed in 4.1.22 · reported by WPScanMedium 5.3
- Aug 21, 2026Eventin: Does not validate a user-supplied webhook URL stored on events nor verify event ownershipCVE-2026-13176 · fixed in 4.1.21 · reported by WPScanLow 2.7
- Aug 19, 2026Eventin: Does not verify ownership before allowing schedule records to be modified or deletedCVE-2026-13175 · fixed in 4.1.21 · reported by WPScanMedium 6.5
- Aug 19, 2026Eventin: Does not verify ownership or capability before deleting user accountsCVE-2026-13174 · fixed in 4.1.21 · reported by WPScanHigh 7.2
- Aug 19, 2026Eventin: Does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creationCVE-2026-13173 · fixed in 4.1.21 · reported by WPScanLow 2.7
- Aug 19, 2026Eventin: Does not properly verify ownership of events before allowing them to be modifiedCVE-2026-13169 · fixed in 4.1.21 · reported by WPScanHigh 8.1
- Aug 13, 2026Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.CVE-2026-28174 · affects up to 4.1.18 · reported by PatchstackMedium 6.5
- Aug 13, 2026Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.CVE-2026-28173 · affects up to 4.1.19 · reported by PatchstackHigh 7.1
- Aug 12, 2026Eventin: Does not properly restrict access to individual order recordsCVE-2026-13177 · fixed in 4.1.20 · reported by WPScanMedium 4.3
- Aug 12, 2026Eventin: Does not perform an authorization check on its waiting-list registration handlerCVE-2026-13171 · fixed in 4.1.20 · reported by WPScanHigh 8.2
- Aug 12, 2026Eventin: Does not properly restrict access to stored customer recordsCVE-2026-13168 · fixed in 4.1.20 · reported by WPScanMedium 6.5
- Aug 10, 2026Eventin: Does not properly validate a template path setting before using it to include a local fileCVE-2026-13170 · fixed in 4.1.20 · reported by WPScanHigh 7.2
- Aug 6, 2026Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.CVE-2026-66451 · affects up to 4.1.9 · reported by PatchstackMedium 6.5
- Jul 30, 2026Eventin: Does not properly authorize order creation and accepts an attacker-supplied order statusCVE-2026-13178 · fixed in 4.1.16 · reported by WPScanHigh 7.5
- Jul 10, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Authorization bypassCVE-2026-13039 · affects up to 4.1.15 · reported by WordfenceMedium 5.3
- Jul 10, 2026Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered): Stored Cross-Site ScriptingCVE-2026-12924 · affects up to 4.1.15 · reported by WordfenceMedium 6.4
- Jun 16, 2026WP Event Solution: Missing AuthorizationCVE-2025-68045 · affects up to 4.1.12 · reported by PatchstackHigh 7.5
- Jun 15, 2026Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.CVE-2026-40776 · affects up to 4.1.8 · reported by PatchstackHigh 7.5
- Jan 22, 2026Eventin: Deserialization of Untrusted DataCVE-2025-68047 · affects up to 4.1.3 · reported by PatchstackHigh 8.8
- Jan 9, 2026Eventin – Event Manager, Events Calendar, Event Tickets and Registrations: Unauthorized modification of dataCVE-2025-14657 · affects up to 4.0.51 · reported by WordfenceHigh 7.2
- Aug 23, 2025Events Calendar, Event Booking, Registrations and Event Tickets – Eventin: Server-Side Request ForgeryCVE-2025-7813 · affects up to 4.0.37 · reported by WordfenceHigh 7.2
- Aug 14, 2025Eventin: Deserialization of Untrusted DataCVE-2025-49869 · affects up to 4.0.31 · reported by PatchstackHigh 8.8
- Aug 8, 2025Eventin: Privilege escalationCVE-2025-4796 · affects up to 4.0.34 · reported by WordfenceHigh 8.8
- Jun 27, 2025Eventin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-49321 · affects up to 4.0.28 · reported by PatchstackHigh 7.1
- May 23, 2025Eventin: Incorrect Privilege AssignmentCVE-2025-47539 · affects up to 4.0.26 · reported by Patchstack25% oddsCritical 9.8
- May 14, 2025Eventin: Relative Path TraversalCVE-2025-47445 · affects up to 4.0.26 · reported by Patchstack5.2% oddsHigh 7.5
- May 8, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Arbitrary file readCVE-2025-3419 · affects up to 4.0.26 · reported by WordfenceHigh 7.5
- Apr 16, 2025Eventin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39584 · affects up to 4.0.25 · reported by PatchstackHigh 7.5
- Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2025-1770 · affects up to 4.0.24 · reported by WordfenceHigh 8.8
- Mar 20, 2025Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized modification of dataCVE-2025-1766 · affects up to 4.0.24 · reported by WordfenceMedium 5.3
- Feb 25, 2025Eventin: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26964 · affects up to 4.0.20 · reported by PatchstackHigh 7.5
- Dec 31, 2024Eventin: Path Traversal: '.../...//'CVE-2024-56213 · affects up to 4.0.7 · reported by PatchstackMedium 6.5
- Dec 9, 2024Eventin: Missing AuthorizationCVE-2023-49756 · affects up to 3.3.52 · reported by PatchstackMedium 5.4
- Sep 27, 2024Event Manager, Events Calendar, Tickets, Registrations – Eventin: Local File InclusionCVE-2024-7149 · affects up to 4.0.8 · reported by Wordfence1.0% oddsHigh 8.8
- Aug 1, 2024Eventin: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39648 · affects up to 4.0.5 · reported by PatchstackMedium 5.9
- Jul 21, 2024Eventin: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37507 · affects up to 3.3.57 · reported by PatchstackMedium 6.5
- Jul 17, 2024Event Manager, Events Calendar, Tickets, Registrations – Eventin: Unauthorized data importationCVE-2024-6033 · affects up to 4.0.4 · reported by WordfenceMedium 4.3
- Feb 9, 2024Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin: Unauthorized access of dataCVE-2024-1122 · affects up to 3.3.50 · reported by WordfenceMedium 5.3
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.