Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Eventin 4.1.20 Clear all filters
TI-2026-11189 CVE-2026-13177 · GHSA-gf78-3gg4-868g

Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

Priority MEDIUM 53

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal info…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-08-12 Fixed in 4.1.20 CWE-639
TI-2026-11183 CVE-2026-13171 · GHSA-cj36-48gw-w6x2

Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint

Priority HIGH 75

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00332 Published 2026-08-12 Fixed in 4.1.20 CWE-284
TI-2026-11180 CVE-2026-13168 · GHSA-prg9-j2xv-c876

Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API

Priority MEDIUM 62

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and ema…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00371 Published 2026-08-12 Fixed in 4.1.20 CWE-200