Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce has 47 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 47 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 13 high. 2026 was the busiest year with 30 disclosures.

The most common weakness is Missing Authorization, behind 21 of the records (45%). Other recurring categories include PHP Remote File Inclusion, Authorization Bypass Through User-Controlled Key.

Every one of the 47 issues recorded for Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce has a vendor fix available, so running the current release closes all known holes.

31 independent researchers contributed these findings, most of them (5) reported by Meher Sudhakar Abbireddi. Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

01234567891028.04.2020Today04.12.20234.3Eventin <= 3.3.52 - Missing Authorization CVSS 4.3 · 04.12.202308.02.20245.3Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export CVSS 5.3 · 08.02.202404.07.20246.4Eventin <= 3.3.57 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 04.07.202416.07.20244.3Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import CVSS 4.3 · 16.07.202401.08.20246.4Eventin <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 01.08.202426.09.20248.8Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 26.09.202419.12.20248.8Eventin <= 4.0.7 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 19.12.202423.02.20258.8Eventin <= 4.0.20 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 23.02.202519.03.20258.8Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 19.03.20255.3Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update CVSS 5.3 · 19.03.202516.04.20258.8Eventin <= 4.0.25 - Authenticated (Contributor+) Local File Inclusion CVSS 8.8 · 16.04.202507.05.20259.8Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation CVSS 9.8 · 07.05.20257.5Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read CVSS 7.5 · 07.05.202523.06.20256.1Eventin <= 4.0.28 - Reflected Cross-Site Scripting CVSS 6.1 · 23.06.202508.08.20258.8Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover CVSS 8.8 · 08.08.202513.08.20257.5Eventin <= 4.0.31 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 13.08.202522.08.20257.2Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery CVSS 7.2 · 22.08.202508.01.20267.2Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' CVSS 7.2 · 08.01.202622.01.20267.5Eventin <= 4.1.3 - Authenticated (Contributor+) PHP Object Injection CVSS 7.5 · 22.01.202613.04.20264.3Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure CVSS 4.3 · 13.04.202629.04.20265.3Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.8 - Missing Authorization CVSS 5.3 · 29.04.202615.06.20265.3Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization CVSS 5.3 · 15.06.202609.07.20265.3Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API CVSS 5.3 · 09.07.20266.4Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameter CVSS 6.4 · 09.07.202604.08.20265.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.16 - Unauthenticated Payment Bypass CVSS 5.3 · 04.08.202605.08.20265.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.9 - Missing Authorization CVSS 5.3 · 05.08.202606.08.20266.6Eventin <= 4.1.19 - Authenticated (Editor+) Local File Inclusion CVSS 6.6 · 06.08.202610.08.20265.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Unauthenticated User Account Creation CVSS 5.3 · 10.08.202613.08.20264.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure CVSS 4.3 · 13.08.20264.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.19 - Authenticated (Customer+) Arbitrary Content Deletion CVSS 4.3 · 13.08.20264.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure CVSS 4.3 · 13.08.20264.3Event SOlution <= 4.1.18 - Authenticated (Customer+) Information Exposure CVSS 4.3 · 13.08.202617.08.20264.3Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Speaker Account Deletion CVSS 4.3 · 17.08.20264.3Eventin <= 4.1.20 - Missing Authorization CVSS 4.3 · 17.08.20264.3Eventin <= 4.1.20 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Event Modification, Deletion and Ownership Takeover CVSS 4.3 · 17.08.20266.3Eventin <= 4.1.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Schedule Deletion and Modification CVSS 6.3 · 17.08.202624.08.20266.4Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Server-Side Request Forgery CVSS 6.4 · 24.08.20265.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.19 - Unauthenticated Order Completion CVSS 5.3 · 24.08.202626.08.20265.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Unauthenticated Information Exposure CVSS 5.3 · 26.08.202601.09.20265.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.22 - Missing Authorization CVSS 5.3 · 01.09.202605.09.20264.3Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.22 - Missing Authorization CVSS 4.3 · 05.09.20266.5Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Path Traversal CVSS 6.5 · 05.09.202608.09.20265.3Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter CVSS 5.3 · 08.09.20267.5Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter CVSS 7.5 · 08.09.20267.5Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter CVSS 7.5 · 08.09.20265.4Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint CVSS 5.4 · 08.09.20264.3Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption CVSS 4.3 · 08.09.2026

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

47

Get automatic notifications for all Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-47539

Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

47 records
2026-09-08 19:18CVE-2026-15398
4.3
Medium
Wordfence PRISMYes
2026-09-08 16:23CVE-2026-11821
5.4
Medium
Sushi Com AbacateYes
2026-09-08 13:49CVE-2026-15667
7.5
High
Wordfence PRISMYes
2026-09-08 13:48CVE-2026-15406
7.5
High
Wordfence PRISMYes
2026-09-08 00:00CVE-2026-12956
5.3
Medium
Wordfence PRISMYes
2026-09-05 00:00CVE-2026-84901
4.3
Medium
Sai Praneeth KotiYes
2026-09-05 00:00CVE-2026-84898
6.5
Medium
Sai Praneeth KotiYes
2026-09-01 00:00CVE-2026-82223
5.3
Medium
20kilogramaYes
2026-08-26 00:00CVE-2026-13172
5.3
Medium
Meher Sudhakar AbbireddiYes
2026-08-24 00:00CVE-2026-13176
6.4
Medium
Yaswanth Reddy SunkaraYes
Showing 1–10 of 47 reports
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce banner
Latestv4.1.24

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

Arraytics

Author

Arraytics

4.7(399)
94/100
Last Updated
2026-09-10 (4d ago)
Active Installs
10,000+
Downloads
893,610
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2020-04-28 (7y ago)

Eventin is a WordPress event calendar, event registration, and event management plugin for creating in-person, virtual, hybrid, and recurring events from a single dashboard. Create free or paid events, manage event listings, sell event tickets online with WooCommerce, Stripe, or PayPal, collect RSVPs, and manage attendees with an easy booking workflow. Eventin also includes AI-powered event creation, helping you generate event titles, descriptions, schedules, and FAQs in seconds. It’s also an excellent choice for eLearning and LMS websites, making it easy to manage live classes, webinars, workshops, coaching sessions, and cohort-based training alongside your courses. Built-in Zoom and Google Meet integrations let you host virtual sessions while recurring events simplify ongoing classes and training programs. Whether you’re organizing a one-day workshop, a multi-day conference, a meetup, or a large business event, Eventin helps you manage event registration, ticket sales, attendee check-in, speaker schedules, and event agendas from one place. QR code check-in tickets, automated confirmation emails, and WooCommerce-powered ticketing provide a smooth experience for both organizers and attendees. The free version includes Zoom integration at no extra cost, allowing attendees to receive meeting links automatically after registration. With Google Meet support, Google Calendar synchronization, iCal, Outlook Calendar, recurring events, and email automation, Eventin gives you everything you need to manage professional events with WordPress. Need help setting up your first event and sell event tickets in WordPress website? 👉 Let Us Know. More helpful links 👇 🎓 Live Demo | 📘 Documentation | 🛣️ Roadmap | 💼 Buy Pro | ⚙️ Features | 🎬 Video Tutorials 🎯 Why Eventin? Eventin combines: – Event Calendar – Booking System – Registration System – Ticketing System 👉 One plugin. Full control. 🗓️ WordPress Event Calendar – Month, Week, Day & List Views Eventin’s event calendar gives your visitors a beautiful, interactive way to browse upcoming events. Display events in a full monthly calendar grid, a compact list view, or a weekly agenda — all fully responsive from mobile to desktop. 🎫 Sell Event Tickets Online – Free, Paid & Early Bird Eventin makes it easy to create and sell event tickets directly from your WordPress site. Offer free events, paid events, or mixed ticketing — no third-party platform needed. 📋 Event Registration, RSVP & Attendee Management Eventin’s event registration system handles everything from collecting attendee information to tracking check-ins — all from one central dashboard. 💻 Virtual, Hybrid & Online Events with Free Zoom Integration Eventin is built for the modern event organizer who runs both in-person and online events. Unlike other event plugins, Eventin includes Zoom integration completely free — no premium add-on required. 🤖 AI-Powered Event Creation for WordPress Eventin is the only WordPress event management plugin with a built-in AI event creator. The Eventin AI tool generates complete event content in under 10 seconds. 🗃️ Event Scheduling & Speaker Management Manage complex multi-session events, conferences, workshops, and multi-day events with Eventin’s powerful scheduling system. 🎨 Event Page Builder & Design Customization Eventin works seamlessly with every major WordPress page builder, giving event organizers full creative control over their event pages. 📢 Who Can Use Eventin? Eventin is designed for anyone who creates and manages events in WordPress: 🎉 Event Planners & Organizers – Create and manage unlimited event listings, sell event tickets, handle registrations, and track attendees. 🏢 Agency Owners – Manage multiple events and event organizers for clients from one dashboard. 🎓 Online Tutors & eLearning Creators – Schedule live classes alongside your LMS courses or independently, run cohort-based programs, manage recurring sessions, and auto-send Zoom or Google Meet links all without a separate webinar tool. With Eventin, you can: Manage live classes, workshops, and webinars Add event registration and booking to your LMS website Schedule cohort-based learning sessions with recurring events Sell access to live training sessions using WooCommerce, Stripe, or PayPal Automatically send Zoom or Google Meet links after registration Track attendees and manage event-based learning experiences 💻 Webinar & Virtual Event Hosts – Run professional online events with automatic Zoom integration and email automation. 🏆 Conference Organizers – Create multi-day event schedules with speakers, sessions, tracks, and ticketing. 🤝 Meetup & Community Hosts – Create RSVP events with attendee limits and optional ticket sales. 📚 Corporate Trainers – Organize training sessions, workshops, and learning programs with structured schedules. 📢 Digital Marketers – Promote events, collect registrations, automate email follow-ups, and track conversion analytics. 🔥 Eventin Free Features — Complete Event Management at $0 Eventin’s free version gives you a full event management experience with no hidden costs. Event Creation & Calendar Unlimited event creation with no usage limits Smart admin dashboard — view all events, registrations, and bookings in one place Full event calendar with monthly, list, and grid views Session and agenda management for multi-session events Recurring events — daily, weekly, monthly, or custom patterns Event import and export for bulk management Upcoming and expired event tabs — auto-sorted and organized Ticketing & Payments Multi-tier ticket pricing — Early Bird, VIP, General Admission, and more WooCommerce integration — accept payments through all WooCommerce gateways Stripe and PayPal direct integration for ticket sales Branded PDF ticket templates sent automatically after purchase WooCommerce coupon support for discount codes Currency settings with symbol position and decimal separator options Purchase confirmation and reminder emails Event Registration & Attendees Event registration forms with custom fields RSVP system with response tracking and reporting Bulk and manual attendee registration Real-time attendee count and capacity management CSV export of attendee data and registration reports QR code check-in generation for every ticket — free Booking management dashboard with full attendee history Virtual Events & Integrations Free Zoom integration — auto-send join links after registration Google Meet integration for online events Google Calendar, iCal, Yahoo, and Outlook sync Hybrid event location support (online + offline) Timezone-aware event scheduling Page Builder & Display Elementor widgets (10+ event-specific widgets). Dedicated Elementor Addons coming soon. Divi, Gutenberg, and Beaver Builder compatibility Drag-and-drop template builder Shortcodes for embedding events anywhere Social sharing buttons for Facebook, Twitter, LinkedIn Advanced event search by keyword, date, category, or tag FAQ section per event page SEO & Event Schema (JSON-LD structured data) for rich search results 🔥 Eventin PRO — Advanced Features & AI Capability The free version handles complete event management. Eventin Pro adds enterprise-level tools for event planners who need more: * Eventin AI – Generate event titles, descriptions, FAQs, tags, and banners in under 10 seconds. * Landing Page Builder – Design custom event landing pages with pre-built templates. * Ticket Template Builder – Design fully branded, custom PDF event tickets. * Certificate Builder – Award attendees with branded PDF certificates for completed events or training sessions. * QR Code – Make an easy event registration experience** with event QR codes check-in. Scan event tickets of your event attendees in just a few seconds. * Visual Seat Map – Create an interactive seating plan and sell tickets by seat location. * Multi-Tier Event Tickets – Advanced tier management with VIP, Gold, group pricing, and bulk sales. * Multivendor Event Marketplace – Build a Dokan-powered marketplace where multiple organizers can list and sell events. Power-Packed Integrations to Make Even Better Events Zapier & Ottokit – Automate event workflows, trigger actions on registration or ticket purchase, and connect Eventin to 1000+ apps without writing code. FluentCRM – Build automated email marketing campaigns for event attendees — send confirmations, follow-ups, and promotional sequences on autopilot. SureCart – Handle payments, refunds, and bookings securely with a faster, modern checkout experience purpose-built for selling event tickets. Google Meet – Host virtual events and online webinars with Google Meet. Attendees receive their join link automatically after event registration. PayPal – Accept PayPal payments for event tickets with a familiar, trusted checkout flow your attendees already use. Stripe – Sell event tickets via Stripe with fast, secure card payments and support for multiple currencies. BuddyBoss – Turn your event attendees into a thriving community. Connect events to BuddyBoss groups for networking, discussions, and shared resources. Divi Builder – Design stunning, fully customized event pages and layouts using Divi’s visual drag-and-drop builder. Pabbly – Connect Eventin to your favorite tools and automate data flow between your event registrations, CRM, and marketing platforms. Twilio – Send SMS reminders, booking confirmations, and real-time event updates directly to your attendees’ phones. 🏆 Trusted by WordPress Experts & 17,500+ Event Organizers Leading WordPress publications and developers recommend Eventin for professional event management: * Elegant Themes: “Eventin is perfect for any kind of Conference, Event, Seminar, Exhibition, Meeting, Business Conference, Webinars, and Event Management website.” * WPAstra: “With a diverse set of features, it is dedicated to simplifying event organization and ensuring a smooth, efficient process.” * Kinsta: “The plugin’s exceptional quality is reflected in user reviews and evidenced by ThemeWinter’s long-standing commitment to delivering top-notch products.” * InstaWP: “Eventin saves time by automating many tasks, allowing you to focus on other aspects of your event management.” 📚 Documentation & Support 📘 Step-by-step Documentation 💬 Support Forum on WordPress.org 👥 Facebook Community Group 🎬 Video Tutorials on YouTube ⭐ Leave a Review on WordPress.org 🌟 Review on Trustpilot 🌟 Review on G2 🚀 Also From ThemeWinter 🍔 WPCafe – Food Ordering & Reservation plugin for WordPress 📅 WPTimetics – AI-powered Appointment Scheduling plugin for WordPress 🗓️ Booktics – Booking plugin for Service Businesses in WordPress 🗓️ Pointics – AI-Powered Loyalty and Rewards Plugin for WordPress External Services This plugin connects to the following external services: Arraytics FluentCRM Service Connects to Arraytics.com’s FluentCRM service to manage contact information for marketing and communication purposes (product updates, feature announcements, support information). Data sent: Your email address (only when you voluntarily provide it during event registration). Service provider: Arraytics – Terms of Service | Privacy Policy Note: This is optional and not required for core plugin functionality. SureCart Webhook Connects to SureCart via webhooks to synchronize order and payment information for event ticketing and related automations. Data sent: Event and order data required to process the webhook (such as ticket/order details, amounts, currency, and customer details like name and email). Payment card details are handled directly by the payment processor, not by this plugin. Service provider: SureCart Inc. – Terms & Conditions | Privacy Policy Note: Optional integration, only active if you enable the SureCart integration and configure its webhooks.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C