+ 17 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2025-47445
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.27 |
Path Traversal relativo (recorrido de ruta relativa) |
Alta
7,5
|
< 4.0.27
|
4.0.27 |
2025-05-14 |
✓ corregido en la última versión
|
|
CVE-2025-47539
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.27 |
Asignación incorrecta de privilegios |
Desconocido
|
< 4.0.27
|
4.0.27 |
2025-05-07 |
✓ corregido en la última versión
|
|
CVE-2025-39584
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.26 |
Control incorrecto del nombre de archivo en una sentencia include/require de PHP (inclusión remota de archivos PHP / RFI) |
Alta
7,5
|
< 4.0.26
|
4.0.26 |
2025-04-16 |
✓ corregido en la última versión
|
|
CVE-2025-26964
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.21 |
Control incorrecto del nombre de archivo en una sentencia include/require de PHP (inclusión remota de archivos PHP / RFI) |
Alta
7,5
|
< 4.0.21
|
4.0.21 |
2025-02-23 |
✓ corregido en la última versión
|
|
CVE-2024-56213
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.9 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Media
6,5
|
< 4.0.9
|
4.0.9 |
2024-12-19 |
✓ corregido en la última versión
|
|
CVE-2024-7149
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.9 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Alta
8,8
|
< 4.0.9
|
4.0.9 |
2024-09-26 |
✓ corregido en la última versión
|
|
CVE-2024-39648
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.6 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 4.0.6
|
4.0.6 |
2024-08-01 |
✓ corregido en la última versión
|
|
CVE-2024-6033
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.5 |
Falta de control de autorización |
Media
4,3
|
< 4.0.5
|
4.0.5 |
2024-07-16 |
✓ corregido en la última versión
|
|
CVE-2024-37507
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.0 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 4.0.0
|
4.0.0 |
2024-07-04 |
✓ corregido en la última versión
|
|
CVE-2024-1122
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 3.3.51 |
Falta de control de autorización |
Media
5,3
|
< 3.3.51
|
3.3.51 |
2024-02-08 |
✓ corregido en la última versión
|
|
CVE-2023-49756
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 3.3.53 |
Falta de control de autorización |
Media
5,4
|
< 3.3.53
|
3.3.53 |
2023-12-04 |
✓ corregido en la última versión
|
|
CVE-2025-1766
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.25 |
Falta de control de autorización |
Media
5,3
|
< 4.0.25
|
4.0.25 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2025-1770
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.25 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Alta
8,8
|
< 4.0.25
|
4.0.25 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2025-3419
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.27 |
Control externo del nombre o la ruta de un archivo |
Alta
7,5
|
< 4.0.27
|
4.0.27 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2025-4796
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.35 |
Elusión de autorización mediante una clave controlada por el usuario |
Alta
8,8
|
< 4.0.35
|
4.0.35 |
0000-00-00 |
✓ corregido en la última versión
|
|
CVE-2026-4109
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.1.9 |
— |
Desconocido
|
< 4.1.9
|
4.1.9 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.38 |
— |
Alta
7,2
|
< 4.0.38
|
4.0.38 |
0000-00-00 |
✓ corregido en la última versión
|
CVE-2025-47445
Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-47539
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the import_items() function in all versions up to, and including, 4.0.26. This makes it possible for unauthenticated attackers to import users that can have the administrator role leading to privilege escalation.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-39584
The Eventin plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.0.25 via the 'events_tab' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-26964
The Eventin plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.0.20. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-56213
The Eventin plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.0.7. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-7149
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.8 via multiple style parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-39648
The Eventin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-6033
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, speakers, schedules and attendee data.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-37507
The Eventin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-1122
Update the WordPress Eventin plugin to the latest available version (at least 3.3.51).
Francesco Carlucci discovered and reported this Broken Access Control vulnerability in WordPress Eventin Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.3.51.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-49756
No patched version is available.
Abdi Pranata discovered and reported this Broken Access Control vulnerability in WordPress Eventin Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has not been known to be fixed yet.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2025-1766
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update the status of ticket payments to 'completed', possibly resulting in financial loss.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-1770
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-3419
The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-4796
The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the plugin not properly validating a user's identity or capability prior to updating their details like email in the 'Eventin\Speaker\Api\SpeakerController::update_item' function. This makes it possible for unauthenticated attackers with contributor-level and above permissions to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-4109
The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the get_item_permissions_check() function in all versions up to, and including, 4.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order data including customer PII (name, email, phone) by iterating order IDs.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution] < 4.0.38
The Events Calendar, Event Booking, Registrations and Event Tickets – Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 via the proxy_image function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Mantén Wp Event Solution actualizado — 4.1.18 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.