CVE-2025-4796

CVE-2025-4796 eventin 并将演讲者邮箱更新为其控制的邮箱。随后攻击者可利用 WordPress 密码重置功能接管管理员账户。 要求 Python 3.8 或更高版本 requests 库 安装 requests： root@kitploit: pip install requests 使用方法 运行脚本并根据提示输入所需值： root@kitploit: python3 CVE-2025-4796.py 输出示例 root@kitploit: + 关闭 SSL 验证警告 + 登录 WordPress + 登录成功 + 获取 nonce 令牌 + 获取到 nonce...

CVE-2026-84906

Eventin WordPress plugin versions before 4.1.24 contain an unauthenticated payment bypass affecting its Stripe and PayPal integrations. The plugin fails to verify that a completed payment corresponds to the specific order it is applied to, checking only that the gateway reports the transaction as...

CVE-2026-84905

The Eventin WordPress plugin (also known as WP Event Solution) before 4.1.24 contains a privilege escalation vulnerability discovered by Karthik Ramakrishnan. When adding a speaker, the plugin fails to verify the acting user's capability to create accounts. This allows any user with contributor-l...

CVE-2026-15398

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.22. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

PT-2026-86350

🚨 CVE-2026-84898 The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files. 🎖@cveNotify...

EUVD-2026-63907

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...

CVE-2026-13175

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

CVE-2026-13173

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

CVE-2026-13177

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

EUVD-2026-57073

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses...

CVE-2026-13170

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...