Eventin vulnerabilities
We track 5 vulnerabilities in Eventin products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 19, 2026.
Latest Eventin vulnerabilities
- 7.2 High severity
Eventin: Improper Access Control
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.
- 8.1 High severity
Eventin: Authorization Bypass Through User-Controlled Key
The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over eve
- 8.2 High severity
Eventin: Improper Access Control
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
- 7.2 High severity
Eventin: Improper Limitation of a Pathname to a Restricted Directory
The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files.
- 7.5 High severity
Eventin: Authorization Bypass Through User-Controlled Key
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.