GCVE - cpe:2.3:a:unknown:eventin:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:eventin:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Eventin (`2b255a66-3bac-5657-bbc6-2a80ecd90552`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-84901`	vulnerable	2026-09-16 04:33:10.311122	Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event and speaker taxonomy terms they should not be able to manage. Published: 2026-09-05T06:00:09.249Z Updated: 2026-09-06T10:36:25.062Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/b1906fd4-82ab-435f-bb07-e8f2db402029/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-84898`	vulnerable	2026-09-16 04:33:10.299742	Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files. Published: 2026-09-05T06:00:08.872Z Updated: 2026-09-06T10:36:53.947Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/d8dea263-5676-4e3c-9ea4-36904e1ac4d3/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-13168`	vulnerable	2026-09-16 04:32:50.350975	Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses. Published: 2026-08-12T06:00:11.879Z Updated: 2026-08-12T19:32:52.444Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/2c5a4930-4676-4ae0-aeb4-1c99d5069361/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-13170`	vulnerable	2026-09-16 04:32:50.326859	Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files. Published: 2026-08-10T06:00:14.549Z Updated: 2026-08-12T15:04:36.503Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/c7bdaa80-a446-4c72-be79-bfc5022a4eca/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-13171`	vulnerable	2026-09-16 04:32:50.246731	Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records. Published: 2026-08-12T06:00:12.053Z Updated: 2026-08-12T19:34:13.605Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/90240025-4dca-4bdb-9698-b63f4c60f413/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-13177`	vulnerable	2026-09-16 04:32:50.134563	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.