329 matches found
CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
CVE-2026-84898
The Eventin WordPress plugin (WP Event Solution) versions prior to 4.1.21 contain a Local File Inclusion (LFI) vulnerability via the Event Layout Meta feature. The plugin fails to properly validate a template path value before including a local file, allowing users with contributor-level access o...
EUVD-2026-71866
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
WordPress Eventin plugin < 4.1.21 - Contributor+ LFI vulnerability
Contributor+ LFI vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.21...
PT-2026-86350
šØ CVE-2026-84898 The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files. š@cveNotify...
PT-2026-86352
šØ CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and dele...
CVE-2026-77694
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...
CVE-2026-13172
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of...
CVE-2026-77694
Eventin (also known as WP Event Solution ) WordPress plugin versions below 4.1.19 contain an unauthenticated order-completion vulnerability . The root cause is improper restriction of which changes a guest checkout token is allowed to authorise on an order. An unauthenticated user can mark their ...
CVE-2026-77694 Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...
WordPress Eventin plugin < 4.1.19 - Unauthenticated Order Completion Without Payment vulnerability
Unauthenticated Order Completion Without Payment vulnerability discovered by Nir Yehoshua in WordPress Plugin WP Event SOlution versions 4.1.19...
EUVD-2026-66284
The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a valid paid ticket with no payment taken...
CVE-2026-13172
Eventin (WP Event Solution) WordPress plugin versions before 4.1.22 fail to restrict access to non-published content by status or ownership in one of its REST API namespaces. This allows unauthenticated users to retrieve draft, pending, and private posts belonging to other users, including the pa...
CVE-2026-13172 Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of...
WordPress Eventin plugin < 4.1.22 - Unauthenticated Unpublished Content Disclosure vulnerability
Unauthenticated Unpublished Content Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.22...
EUVD-2026-66265
The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging to other users, along with the passwords and contents of...
CVE-2026-13176
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
EUVD-2026-63907
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
CVE-2026-13176 Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...