CVE-2025-47539

🚨 CVE-2025-47539 – Exploit Critico del Plugin Eventin per WordPress 🔥 Riepilogo della Vulnerabilità Il plugin Event Manager, Events Calendar, Tickets, Registrations – Eventin per WordPress è vulnerabile a escalation di privilegi non autenticata a causa di un controllo di autorizzazione mancante...

WordPress Eventin plugin < 4.1.19 - Unauthenticated Order Completion Without Payment vulnerability

Unauthenticated Order Completion Without Payment vulnerability discovered by Nir Yehoshua in WordPress Plugin WP Event SOlution versions 4.1.19...

CVE-2025-4796

CVE-2025-4796 Eventin Una volta modificata l'email con un indirizzo controllato dall'attaccante, il flusso standard di reset della password di WordPress può essere utilizzato per prendere il control...

CVE-2026-13174

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

EUVD-2026-55023

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...

CVE-2026-13170

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...

CVE-2026-13170

The Eventin WordPress plugin is affected up to version 4.1.20. The root cause is improper validation of a template path in the speaker_template setting, which is used to include a local file. This allows users with editor-level access and above to include and execute arbitrary local PHP files, en...

CVE-2026-13170 Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...

CVE-2026-13178

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178

CVE-2026-13178 affects the Eventin WordPress plugin, prior to version 4.1.16. The vulnerability allows unauthenticated attackers to create orders and set an attacker-controlled order status, resulting in orders being marked as paid without real payment completion. This stems from improper authori...

CVE-2026-13178

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

EUVD-2026-51009

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13039

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...

EUVD-2026-43025

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...

CVE-2026-13039 Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...

CVE-2026-13039

The Eventin plugin for WordPress (versions 4.0.26–4.1.15) has an authorization bypass in payment_complete() via REST API due to insufficient verification of user authorization. Unauthenticated attackers can mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or ...

CVE-2026-12924

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etnfaqcontent' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-12924 Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etnfaqcontent' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it...