CVE-2026-15398

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.1.22 . The root cause is a failure to properly verify user authorization for specific actions. This allows authentic...

CVE-2026-12956

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

CVE-2026-12956: Missing Authorization

The WP Event Solution Eventin plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the createitem handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's createitempermissionscheck function only verifies a wprest nonce which is...

CVE-2026-14823

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not...

WordPress Event Tickets and Registration plugin < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification vulnerability

Contributor+ Seating Layout and Ticket Inventory Modification vulnerability discovered by Shivamani Vastrala in WordPress Plugin Event Tickets versions 5.29.0.1...

PT-2026-67049

Name of the Vulnerable Software and Affected Versions Event Tickets and Registration WordPress plugin versions prior to 5.29.0.1 Description Insufficient authorization verification on certain seating actions allows users with contributor-level access or higher to perform an Insecure Direct Object...