Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:eventin:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Eventin (2b255a66-3bac-5657-bbc6-2a80ecd90552) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-84907 |
vulnerable | 2026-10-13 12:28:55.804410 |
Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.
Published: 2026-09-16T06:00:13.789Z
Updated: 2026-09-17T12:37:06.637Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84906 |
vulnerable | 2026-10-13 12:28:55.610069 |
Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay
MEDIUM (5.3)
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
Published: 2026-09-16T06:30:08.569Z
Updated: 2026-09-16T17:38:34.724Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84905 |
vulnerable | 2026-10-13 12:28:55.453211 |
Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
Published: 2026-09-16T06:00:13.363Z
Updated: 2026-09-17T12:37:22.638Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-77702 |
vulnerable | 2026-10-13 12:28:29.540412 |
Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
Published: 2026-09-16T06:00:11.967Z
Updated: 2026-09-17T12:39:24.565Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84901 |
vulnerable | 2026-09-16 04:33:10.311122 |
Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage.
Published: 2026-09-05T06:00:09.249Z
Updated: 2026-09-06T10:36:25.062Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84898 |
vulnerable | 2026-09-16 04:33:10.299742 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13168 |
vulnerable | 2026-09-16 04:32:50.350975 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13170 |
vulnerable | 2026-09-16 04:32:50.326859 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13171 |
vulnerable | 2026-09-16 04:32:50.246731 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13177 |
vulnerable | 2026-09-16 04:32:50.134563 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.