CVE-2025-4796

CVE-2025-4796 Eventin Once the email is changed to an attacker-controlled address, the standard WordPress password reset flow can be used to take over the account. 🧰 Script PoC Filename: CVE-2025-4796.py This script automates the steps: 1. Log in to the target WordPress site using supplied...

CVE-2025-47539

🚨 CVE-2025-47539 – WordPress Eventin 插件严重漏洞利用 🔥 漏洞摘要 WordPress 的 Event Manager, Events Calendar, Tickets, Registrations – Eventin 插件因 importitems 函数缺少授权检查，存在 未认证权限提升 漏洞。 🔓 受影响版本： ⚠️ 本脚本仅用于教育目的和专业安全评估。 ⚙️ 使用方法 root@kitploit: usage: a.py -h -u URL Exploit for CVE-2025-47539 By Nxploited Khaled...

CVE-2026-15398

The Eventin WordPress plugin (Event Calendar, Event Registration, Tickets & Booking, AI Powered) is vulnerable to an authorization bypass in all versions up to and including 4.1.22 . The root cause is improper authorization verification in the OrderController , where the wp_rest nonce is publicly...

CVE-2026-15406

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level...

CVE-2026-15667

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-74542

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-74568

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'eventlayout' parameter parameter. This makes it possible for authenticated attackers, with custom-level...

PT-2026-88767

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event layout' parameter parameter. This makes it possible for authenticated attackers, with...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management vulnerability

Missing Authorization to Authenticated Subscriber+ Notification Flow Management vulnerability discovered by Sushi Com Abacate in WordPress Plugin WP Event SOlution versions = 4.1.17...

WordPress Eventin plugin < 4.1.19 - Unauthenticated Order Completion Without Payment vulnerability

Unauthenticated Order Completion Without Payment vulnerability discovered by Nir Yehoshua in WordPress Plugin WP Event SOlution versions 4.1.19...

CVE-2026-13174

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts...

CVE-2026-13170

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...

EUVD-2026-55023

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...

CVE-2026-13170

The Eventin WordPress plugin is affected up to version 4.1.20. The root cause is improper validation of a template path in the speaker_template setting, which is used to include a local file. This allows users with editor-level access and above to include and execute arbitrary local PHP files, en...

CVE-2026-13170 Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting

The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files...

CVE-2026-13178

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178

CVE-2026-13178 affects the Eventin WordPress plugin, prior to version 4.1.16. The vulnerability allows unauthenticated attackers to create orders and set an attacker-controlled order status, resulting in orders being marked as paid without real payment completion. This stems from improper authori...

CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...

CVE-2026-13178

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...